Split generic and local deleted files

Simplify the inline clean script
clean K* files in inline system test directory
2019-02-05 21:32:00 -08:00 · 2019-02-06 16:24:39 +11:00 · 2019-02-06 16:24:39 +11:00
888 changed files with 14202 additions and 23443 deletions
@@ -15,6 +15,9 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "./"))

+	       ;; current directory
+	       (expand-file-name (concat default-directory "./"))
+
 	       ;; libisc
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/isc/unix/include"))
@@ -22,16 +25,11 @@
 		(concat directory-of-current-dir-locals-file "lib/isc/pthreads/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/isc/include"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "lib/isc"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "lib/isc/netmgr"))

 	       ;; libdns
+
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/dns/include"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "lib/dns"))

 	       ;; libisccc
 	       (expand-file-name
@@ -53,28 +51,6 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/bind9/include"))

-	       ;; bin
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/check"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/confgen/include"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/confgen"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/confgen/include"))	       
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/dig/include"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/named/include"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/rndc/include"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/dnssec/include"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/named/include"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/rndc/include"))
-
 	       (expand-file-name "/usr/local/opt/openssl@1.1/include")
 	       (expand-file-name "/usr/local/opt/libxml2/include/libxml2")
 	       (expand-file-name "/usr/local/include")
@@ -1,58 +1,36 @@
-*-symtbl.c
-*.a
-*.gcda
-*.gcno
-*.la
-*.lo
-*.o
-*.orig
-*.plist/ # ccc-analyzer store its results in .plist directories
+Makefile
+config.log
+config.h
+config.cache
+config.status
+libtool
+/isc-config.sh
+/configure.lineno
+autom4te.cache/
 *.rej
+*.orig
+*.o
+*.lo
 *.so
+*.a
+*.la
+*.gcno
+*.gcda
 *_test
-*~
+*-symtbl.c
+timestamp
+ans.run
+named.run
+named.memstats
+gen.dSYM/
 .ccache/
-.cproject
 .deps/
 .dirstamp
 .libs/
+# ccc-analyzer store its results in .plist directories
+*.plist/
+*~
 .project
+.cproject
 .settings
-/aclocal.m4
-/ar-lib
-/autom4te.cache/
-/bind.keys.h
-/compile
-/config.cache
-/config.guess
-/config.h
-/config.h.in
-/config.log
-/config.status
-/config.sub
-/configure
-/configure.lineno
-/depcomp
-/install-sh
-/isc-config.sh
-/libltdl/*
-/libtool
-/ltmain.sh
-/m4/libtool.m4
-/m4/ltargz.m4
-/m4/ltdl.m4
-/m4/ltoptions.m4
-/m4/ltsugar.m4
-/m4/ltversion.m4
-/m4/lt~obsolete.m4
-/missing
-/py-compile
-/stamp-h1
-/test-driver
-Makefile
-ans.run
-gen.dSYM/
-kyua.log
-named.memstats
-named.run
-timestamp
+kyua.log
@@ -8,30 +8,14 @@ variables:
  CCACHE_DIR: "/ccache"
  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"

-  # VirtualBox driver needs to set build_dir to "/builds" in gitlab-runner.toml
-  KYUA_RESULT: "$CI_PROJECT_DIR/kyua.results"
-
-  GIT_DEPTH: 1
-  BUILD_PARALLEL_JOBS: 6
-  TEST_PARALLEL_JOBS: 6
-
 stages:
  - precheck
  - build
-  - unit
-  - system
-  - docs
+  - test
  - push

 ### Runner Tag Templates

-# Note: FreeBSD runners extract the FreeBSD version to use from job name
-
-.freebsd-amd64: &freebsd_amd64
-  tags:
-    - freebsd
-    - amd64
-
 .linux-amd64: &linux_amd64
  tags:
    - linux
@@ -44,12 +28,6 @@ stages:

 ### Docker Image Templates

-# Alpine Linux
-
-.alpine-3.10-amd64: &alpine_3_10_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.10-amd64"
-  <<: *linux_amd64
-
 # CentOS

 .centos-centos6-amd64: &centos_centos6_amd64_image
@@ -66,6 +44,10 @@ stages:
  image: "$CI_REGISTRY_IMAGE:debian-jessie-amd64"
  <<: *linux_amd64

+.debian-jessie-i386: &debian_jessie_i386_image
+  image: "$CI_REGISTRY_IMAGE:debian-jessie-i386"
+  <<: *linux_i386
+
 .debian-stretch-amd64: &debian_stretch_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-stretch-amd64"
  <<: *linux_amd64
@@ -74,10 +56,6 @@ stages:
  image: "$CI_REGISTRY_IMAGE:debian-stretch-i386"
  <<: *linux_i386

-.debian-buster-amd64: &debian_buster_amd64_image
-  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
-  <<: *linux_i386
-
 .debian-sid-amd64: &debian_sid_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
  <<: *linux_amd64
@@ -88,8 +66,8 @@ stages:

 # Fedora

-.fedora-30-amd64: &fedora_30_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-30-amd64"
+.fedora-29-amd64: &fedora_29_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-29-amd64"
  <<: *linux_amd64

 # Ubuntu
@@ -123,65 +101,26 @@ stages:
  <<: *debian_sid_amd64_image
  stage: precheck

-.autoconf: &autoconf_job
-  <<: *default_triggering_rules
-  <<: *debian_sid_amd64_image
-  stage: precheck
-  script:
-    - autoreconf -fi
-  artifacts:
-    untracked: true
-    expire_in: "1 hour"
-
-.configure: &configure |
-    ./configure \
-    --disable-maintainer-mode \
-    --enable-developer \
-    --with-libtool \
-    --with-geoip2=auto \
-    --disable-static \
-    --with-cmocka \
-    --with-libxml2 \
-    --with-json \
-    --prefix=$HOME/.local \
-    --without-make-clean \
-    $EXTRA_CONFIGURE \
-    || cat config.log
-
 .build: &build_job
  <<: *default_triggering_rules
  stage: build
  before_script:
    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
  script:
-    - *configure
+    - ./configure --enable-developer --with-libtool --disable-static --with-cmocka --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
    - test -z "${RUN_MAKE_INSTALL}" || make install
-  dependencies:
-    - autoreconf:sid:amd64
-  needs:
-    - autoreconf:sid:amd64
  artifacts:
    untracked: true
    expire_in: "1 hour"

-.setup_interfaces: &setup_interfaces |
-    if [ "$(id -u)" -eq "0" ]; then
-      sh -x bin/tests/system/ifconfig.sh up;
-    else
-      sudo sh -x bin/tests/system/ifconfig.sh up;
-    fi
-
-.setup_softhsm: &setup_softhsm |
-    sh -x util/prepare-softhsm2.sh
-
 .system_test: &system_test_job
  <<: *default_triggering_rules
-  stage: system
+  stage: test
  retry: 2
  before_script:
-    - *setup_interfaces
-    - *setup_softhsm
+    - bash -x bin/tests/system/ifconfig.sh up
+    - bash -x util/prepare-softhsm2.sh
  script:
    - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
    - test -s bin/tests/system/systests.output
@@ -190,22 +129,16 @@ stages:
    expire_in: "1 week"
    when: on_failure

-.kyua_report: &kyua_report_html |
-  kyua --logfile /dev/null report-html \
-       --force \
-       --results-file "$KYUA_RESULT" \
-       --results-filter "" \
-       --output kyua_html
-
 .unit_test: &unit_test_job
  <<: *default_triggering_rules
-  stage: unit
+  stage: test
  before_script:
-    - *setup_softhsm
+    - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
+    - bash -x util/prepare-softhsm2.sh
  script:
    - make unit
  after_script:
-    - *kyua_report_html
+    - kyua report-html --force --results-file kyua.results --results-filter "" --output kyua_html
  artifacts:
    paths:
      - kyua.log
@@ -218,13 +151,9 @@ stages:

 # Jobs in the precheck stage

-autoreconf:sid:amd64:
-  <<: *autoconf_job
-
 misc:sid:amd64:
  <<: *precheck_job
  script:
-    - sh util/check-ans-prereq.sh
    - sh util/checklibs.sh > checklibs.out
    - sh util/tabify-changes < CHANGES > CHANGES.tmp
    - diff -urNap CHANGES CHANGES.tmp
@@ -237,7 +166,6 @@ misc:sid:amd64:
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
    - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
    - xmllint --noout --nonet --html `git ls-files '*.html'`
-    - sh util/check-win32util-configure
  artifacts:
    paths:
      - util/newcopyrights
@@ -247,23 +175,17 @@ misc:sid:amd64:

 🐞:sid:amd64:
  <<: *precheck_job
-  script:
-    - util/check-cocci
-    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
+  script: util/check-cocci

 # Jobs for doc builds on Debian Sid (amd64)

 docs:sid:amd64:
  <<: *debian_sid_amd64_image
-  stage: docs
+  stage: build
  script:
    - ./configure || cat config.log
    - make -C doc/misc docbook
    - make -C doc/arm Bv9ARM.html
-  dependencies:
-    - autoreconf:sid:amd64
-  needs:
-    - autoreconf:sid:amd64
  artifacts:
    paths:
      - doc/arm/
@@ -285,30 +207,6 @@ push:docs:sid:amd64:
    - master@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9

-# Jobs for regular GCC builds on Alpine Linux 3.10 (amd64)
-
-gcc:alpine3.10:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--enable-dnstap"
-  <<: *alpine_3_10_amd64_image
-  <<: *build_job
-
-system:gcc:alpine3.10:amd64:
-  <<: *alpine_3_10_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - gcc:alpine3.10:amd64
-  needs: ["gcc:alpine3.10:amd64"]
-
-unit:gcc:alpine3.10:amd64:
-  <<: *alpine_3_10_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - gcc:alpine3.10:amd64
-  needs: ["gcc:alpine3.10:amd64"]
-
 # Jobs for regular GCC builds on CentOS 6 (amd64)

 gcc:centos6:amd64:
@@ -324,14 +222,12 @@ system:gcc:centos6:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:centos6:amd64
-  needs: ["gcc:centos6:amd64"]

 unit:gcc:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:centos6:amd64
-  needs: ["gcc:centos6:amd64"]

 # Jobs for regular GCC builds on CentOS 7 (amd64)

@@ -339,7 +235,7 @@ gcc:centos7:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *centos_centos7_amd64_image
  <<: *build_job

@@ -348,14 +244,12 @@ system:gcc:centos7:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:centos7:amd64
-  needs: ["gcc:centos7:amd64"]

 unit:gcc:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:centos7:amd64
-  needs: ["gcc:centos7:amd64"]

 # Jobs for regular GCC builds on Debian 8 Jessie (amd64)

@@ -363,7 +257,7 @@ gcc:jessie:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--without-cmocka --with-python --disable-geoip"
+    EXTRA_CONFIGURE: "--without-cmocka --with-python"
  <<: *debian_jessie_amd64_image
  <<: *build_job

@@ -372,14 +266,12 @@ system:gcc:jessie:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:jessie:amd64
-  needs: ["gcc:jessie:amd64"]

 unit:gcc:jessie:amd64:
  <<: *debian_jessie_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:jessie:amd64
-  needs: ["gcc:jessie:amd64"]

 # Jobs for regular GCC builds on Debian 9 Stretch (amd64)

@@ -395,45 +287,20 @@ system:gcc:stretch:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:stretch:amd64
-  needs: ["gcc:stretch:amd64"]

 unit:gcc:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:stretch:amd64
-  needs: ["gcc:stretch:amd64"]
-
-# Jobs for regular GCC builds on Debian 10 Buster (amd64)
-
-gcc:buster:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-  <<: *debian_buster_amd64_image
-  <<: *build_job
-
-system:gcc:buster:amd64:
-  <<: *debian_buster_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - gcc:buster:amd64
-  needs: ["gcc:buster:amd64"]
-
-unit:gcc:buster:amd64:
-  <<: *debian_buster_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - gcc:buster:amd64
-  needs: ["gcc:buster:amd64"]

 # Jobs for regular GCC builds on Debian Sid (amd64)

 gcc:sid:amd64:
  variables:
    CC: gcc
-    CFLAGS: "-Wall -Wextra -O3 -g"
-    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
    RUN_MAKE_INSTALL: 1
  <<: *debian_sid_amd64_image
  <<: *build_job
@@ -443,22 +310,20 @@ system:gcc:sid:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:sid:amd64
-  needs: ["gcc:sid:amd64"]

 unit:gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:sid:amd64
-  needs: ["gcc:sid:amd64"]

 # Jobs for regular GCC builds on Debian Sid (i386)

 gcc:sid:i386:
  variables:
    CC: gcc
-    CFLAGS: "-Wall -Wextra -O3 -g"
-    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 --without-python"
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-python"
  <<: *debian_sid_i386_image
  <<: *build_job

@@ -467,38 +332,34 @@ system:gcc:sid:i386:
  <<: *system_test_job
  dependencies:
    - gcc:sid:i386
-  needs: ["gcc:sid:i386"]

 unit:gcc:sid:i386:
  <<: *debian_sid_i386_image
  <<: *unit_test_job
  dependencies:
    - gcc:sid:i386
-  needs: ["gcc:sid:i386"]

-# Jobs for regular GCC builds on Fedora 30 (amd64)
+# Jobs for regular GCC builds on Fedora 29 (amd64)

-gcc:fedora30:amd64:
+gcc:fedora29:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *fedora_30_amd64_image
+  <<: *fedora_29_amd64_image
  <<: *build_job

-system:gcc:fedora30:amd64:
-  <<: *fedora_30_amd64_image
+system:gcc:fedora29:amd64:
+  <<: *fedora_29_amd64_image
  <<: *system_test_job
  dependencies:
-    - gcc:fedora30:amd64
-  needs: ["gcc:fedora30:amd64"]
+    - gcc:fedora29:amd64

-unit:gcc:fedora30:amd64:
-  <<: *fedora_30_amd64_image
+unit:gcc:fedora29:amd64:
+  <<: *fedora_29_amd64_image
  <<: *unit_test_job
  dependencies:
-    - gcc:fedora30:amd64
-  needs: ["gcc:fedora30:amd64"]
+    - gcc:fedora29:amd64

 # Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)

@@ -506,7 +367,6 @@ gcc:xenial:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--disable-geoip"
  <<: *ubuntu_xenial_amd64_image
  <<: *build_job

@@ -515,14 +375,12 @@ system:gcc:xenial:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:xenial:amd64
-  needs: ["gcc:xenial:amd64"]

 unit:gcc:xenial:amd64:
  <<: *ubuntu_xenial_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:xenial:amd64
-  needs: ["gcc:xenial:amd64"]

 # Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)

@@ -539,14 +397,12 @@ system:gcc:bionic:amd64:
  <<: *system_test_job
  dependencies:
    - gcc:bionic:amd64
-  needs: ["gcc:bionic:amd64"]

 unit:gcc:bionic:amd64:
  <<: *ubuntu_bionic_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:bionic:amd64
-  needs: ["gcc:bionic:amd64"]

 # Jobs for GCC builds with ASAN enabled on Debian Sid (amd64)

@@ -564,14 +420,12 @@ system:asan:sid:amd64:
  <<: *system_test_job
  dependencies:
    - asan:sid:amd64
-  needs: ["asan:sid:amd64"]

 unit:asan:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - asan:sid:amd64
-  needs: ["asan:sid:amd64"]

 # Jobs for Clang builds on Debian Stretch (amd64)

@@ -588,7 +442,6 @@ unit:clang:stretch:amd64:
  <<: *unit_test_job
  dependencies:
    - clang:stretch:amd64
-  needs: ["clang:stretch:amd64"]

 # Jobs for Clang builds on Debian Stretch (i386)

@@ -615,139 +468,9 @@ system:pkcs11:sid:amd64:
  <<: *system_test_job
  dependencies:
    - pkcs11:sid:amd64
-  needs: ["pkcs11:sid:amd64"]

 unit:pkcs11:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - pkcs11:sid:amd64
-  needs: ["pkcs11:sid:amd64"]
-
-# Jobs for Clang builds on FreeBSD 11.3 (amd64)
-
-clang:freebsd11.3:amd64:
-  variables:
-    CFLAGS: "-Wall -Wextra -O2 -g"
-  <<: *freebsd_amd64
-  <<: *build_job
-
-system:clang:freebsd11.3:amd64:
-  <<: *freebsd_amd64
-  <<: *system_test_job
-  dependencies:
-    - clang:freebsd11.3:amd64
-  needs: ["clang:freebsd11.3:amd64"]
-
-unit:clang:freebsd11.3:amd64:
-  <<: *freebsd_amd64
-  <<: *unit_test_job
-  dependencies:
-    - clang:freebsd11.3:amd64
-  needs: ["clang:freebsd11.3:amd64"]
-
-# Jobs for Clang builds on FreeBSD 12.0 (amd64)
-
-clang:freebsd12.0:amd64:
-  variables:
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--enable-dnstap"
-  <<: *freebsd_amd64
-  <<: *build_job
-
-system:clang:freebsd12.0:amd64:
-  <<: *freebsd_amd64
-  <<: *system_test_job
-  dependencies:
-    - clang:freebsd12.0:amd64
-  needs: ["clang:freebsd12.0:amd64"]
-
-unit:clang:freebsd12.0:amd64:
-  <<: *freebsd_amd64
-  <<: *unit_test_job
-  dependencies:
-    - clang:freebsd12.0:amd64
-  needs: ["clang:freebsd12.0:amd64"]
-
-# Jobs with libtool disabled
-
-nolibtool:sid:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -Og -g"
-    EXTRA_CONFIGURE: "--with-libidn2 --without-libtool --with-dlopen"
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-
-system:nolibtool:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - nolibtool:sid:amd64
-  needs: ["nolibtool:sid:amd64"]
-
-unit:nolibtool:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - nolibtool:sid:amd64
-  needs: ["nolibtool:sid:amd64"]
-
-# Jobs for Visual Studio 2017 builds on Windows (amd64)
-
-msvc:windows:amd64:
-  <<: *default_triggering_rules
-  stage: build
-  tags:
-    - windows
-    - amd64
-  variables:
-    VSCONF: Release
-  script:
-    - 'Push-Location "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Auxiliary/Build"'
-    - '& cmd.exe /C "vcvarsall.bat x64 & set" | Foreach-Object { if ($_ -match "(.*?)=(.*)") { Set-Item -force -path "Env:\$($matches[1])" -value "$($matches[2])" } }'
-    - 'Pop-Location'
-    - 'Set-Location win32utils'
-    - '& "C:/Strawberry/perl/bin/perl.exe" Configure
-         "with-tools-version=15.0"
-         "with-platform-toolset=v141"
-         "with-platform-version=10.0.17763.0"
-         "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
-         "with-openssl=C:/OpenSSL"
-         "with-libxml2=C:/libxml2"
-         "without-python"
-         "with-system-tests"
-         x64'
-    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
-    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
-  artifacts:
-    untracked: true
-    expire_in: "1 hour"
-
-system:msvc:windows:amd64:
-  stage: system
-  tags:
-    - windows
-    - amd64
-  variables:
-    VSCONF: Release
-  script:
-    - 'Push-Location bin/tests/system'
-    - '$ifIndex = Get-NetIPInterface -AddressFamily IPv4 -InterfaceMetric 75 | Select-Object -ExpandProperty ifIndex'
-    - '& C:/tools/cygwin/bin/sed.exe -i "s/^exit.*/netsh interface ipv4 set dnsservers $ifIndex dhcp/; s/\(name\|interface\)=Loopback/$ifIndex/;" ifconfig.bat'
-    - '& C:/tools/cygwin/bin/sed.exe -i "s/kill -f/kill -W/;" conf.sh stop.pl'
-    - '& cmd.exe /C ifconfig.bat up; ""'
-    - 'Start-Sleep 2'
-    - '$Env:Path = "C:/tools/cygwin/bin;$Env:Path"'
-    - '& sh.exe runall.sh $TEST_PARALLEL_JOBS'
-    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
-  dependencies:
-    - msvc:windows:amd64
-  needs: ["msvc:windows:amd64"]
-  artifacts:
-    untracked: true
-    expire_in: "1 week"
-    when: on_failure
-  only:
-    - tags
-    - web
@@ -1,403 +1,3 @@
-	--- 9.14.7 released ---
-
-5299.	[security]	A flaw in DNSSEC verification when transferring
-			mirror zones could allow data to be incorrectly
-			marked valid. (CVE-2019-6475) [GL #16P]
-
-5298.	[security]	Named could assert if a forwarder returned a
-			referral, rather than resolving the query, when QNAME
-			minimization was enabled. (CVE-2019-6476) [GL #1051]
-
-5297.	[bug]		Check whether a previous QNAME minimization fetch
-			is still running before starting a new one; return
-			SERVFAIL and log an error if so. [GL #1191]
-
-5294.	[func]		Fallback to ACE name on output in locale, which does not
-			support converting it to unicode.  [GL #846]
-
-5293.	[bug]		On Windows, named crashed upon any attempt to fetch XML
-			statistics from it. [GL #1245]
-
-5292.	[bug]		Queue 'rndc nsec3param' requests while signing inline
-			zone changes. [GL #1205]
-
-	--- 9.14.6 released ---
-
-5289.	[bug]		Address NULL pointer dereference in rpz.c:rpz_detach.
-			[GL #1210]
-
-5286.	[contrib]	Address potential NULL pointer dereferences in
-			dlz_mysqldyn_mod.c. [GL #1207]
-
-5285.	[port]		win32: implement "-T maxudpXXX". [GL #837]
-
-5283.	[bug]		When a response-policy zone expires, ensure that
-			its policies are removed from the RPZ summary
-			database. [GL #1146]
-
-5282.	[bug]		Fixed a bug in searching for possible wildcard matches
-			for query names in the RPZ summary database. [GL #1146]
-
-5281.	[cleanup]	Don't escape commas when reporting named's command
-			line. [GL #1189]
-
-5280.	[protocol]	Add support for displaying EDNS option LLQ. [GL #1201]
-
-5279.	[bug]		When loading, reject zones containing CDS or CDNSKEY
-			RRsets at the zone apex if they would cause DNSSEC
-			validation failures if published in the parent zone
-			as the DS RRset.  [GL #1187]
-
-	--- 9.14.5 released ---
-
-5277.	[bug]		Cache DB statistics could underflow when serve-stale
-			was in use, because of a bug in counter maintenance
-			when RRsets become stale.
-
-			Functions for dumping statistics have been updated
-			to dump active, stale, and ancient statistic
-			counters.  Ancient RRset counters are prefixed
-			with '~'; stale RRset counters are still prefixed
-			with '#'. [GL #602]
-
-5275.	[bug]		Mark DS records included in referral messages
-			with trust level "pending" so that they can be
-			validated and cached immediately, with no need to
-			re-query. [GL #964]
-
-5274.	[bug]		Address potential use after free race when shutting
-			down rpz. [GL #1175]
-
-5273.	[bug]		Check that bits [64..71] of a dns64 prefix are zero.
-			[GL #1159]
-
-5269.	[port]		cygwin: can return ETIMEDOUT on connect() with a
-			non-blocking socket. [GL #1133]
-
-5268.	[bug]		named could crash during configuration if
-			configured to use "geoip continent" ACLs with
-			legacy GeoIP. [GL #1163]
-
-5266.	[bug]		named-checkconf failed to report dnstap-output
-			missing from named.conf when dnstap was specified.
-			[GL #1136]
-
-5265.	[bug]		DNS64 and RPZ nodata (CNAME *.) rules interacted badly
-			[GL #1106]
-
-5264.	[func]		New DNS Cookie algorithm - siphash24 - has been added
-			to BIND 9. [GL #605]
-
-5236.	[func]		Add SipHash 2-4 implementation in lib/isc/siphash.c
-			and switch isc_hash_function() to use SipHash 2-4.
-			[GL #605]
-
-	--- 9.14.4 released ---
-
-5260.	[bug]		dnstap-read was producing malformed output for large
-			packets. [GL #1093]
-
-5258.	[func]		Added support for the GeoIP2 API from MaxMind,
-			when BIND is compiled using "configure --with-geoip2".
-			The legacy GeoIP API can be enabled by using
-			"configure --with-geoip" instead. These options
-			cannot be used together.
-
-			Certain geoip ACL settings that were available with
-			legacy GeoIP are not available when using GeoIP2.
-			See the ARM for details. [GL #182]
-
-5257.	[bug]		Some statistics data was not being displayed.
-			Add shading to the zone tables. [GL #1030]
-
-5256.	[bug]		Ensure that glue records are included in root
-			priming responses if "minimal-responses" is not
-			set to "yes". [GL #1092]
-
-5255.	[bug]		Errors encountered while reloading inline-signing
-			zones could be ignored, causing the zone content to
-			be left in an incompletely updated state rather than
-			reverted. [GL #1109]
-
-5254.	[func]		Collect metrics to report to the statistics-channel
-			DNSSEC signing operations (dnssec-sign) and refresh
-			operations (dnssec-refresh) per zone and per keytag.
-			[GL #513]
-
-5253.	[port]		Support platforms that don't define ULLONG_MAX.
-			[GL #1098]
-
-5251.	[bug]		Statistics were broken in x86 Windows builds.
-			[GL #1081]
-
-5249.	[bug]		Fix a possible underflow in recursion clients
-			statistics when hitting recursive clients
-			soft quota. [GL #1067]
-
-	--- 9.14.3 released ---
-
-5244.	[security]	Fixed a race condition in dns_dispatch_getnext()
-			that could cause an assertion failure if a
-			significant number of incoming packets were
-			rejected. (CVE-2019-6471) [GL #942]
-
-5243.	[bug]		Fix a possible race between dispatcher and socket
-			code in a high-load cold-cache resolver scenario.
-			[GL #943]
-
-5242.	[bug]		In relaxed qname minimization mode, fall back to
-			normal resolution when encountering a lame
-			delegation, and use _.domain/A queries rather
-			than domain/NS. [GL #1055]
-
-5241.	[bug]		Fix Ed448 private and public key ASN.1 prefix blobs.
-			[GL #225]
-
-5240.	[bug]		Remove key id calculation for RSAMD5. [GL #996]
-
-5238.	[bug]		Fix a possible deadlock in TCP code. [GL #1046]
-
-5237.	[bug]		Recurse to find the root server list with 'dig +trace'.
-			[GL #1028]
-
-5234.	[port]		arm: just use the compiler's default support for
-			yield. [GL #981]
-
-	--- 9.14.2 released ---
-
-5233.	[bug]		Negative trust anchors did not work with "forward only;"
-			to validating resolvers. [GL #997]
-
-5231.	[protocol]	Add support for displaying CLIENT-TAG and SERVER-TAG.
-			[GL #960]
-
-5229.	[protocol]	Enforce known SSHFP fingerprint lengths. [GL #852]
-
-5228.	[cleanup]	If trusted-keys and managed-keys are configured
-			simultaneously for the same name, the key cannot
-			be rolled automatically. This configuration now
-			logs a warning. [GL #868]
-
-5224.	[bug]		Only test provide-ixfr on TCP streams. [GL #991]
-
-5223.	[bug]		Fixed a race in the filter-aaaa plugin accessing
-			the hash table. [GL #1005]
-
-5222.	[bug]		'delv -t ANY' could leak memory. [GL #983]
-
-5221.	[test]		Enable parallel execution of system tests on
-			Windows. [GL !4101]
-
-5220.	[cleanup]	Refactor the isc_stat structure to take advantage
-			of stdatomic. [GL !1493]
-
-5219.	[bug]		Fixed a race in the filter-aaaa plugin that could
-			trigger a crash when returning an instance object
-			to the memory pool. [GL #982]
-
-5218.	[bug]		Conditionally include <dlfcn.h>. [GL #995]
-
-5217.	[bug]		Restore key id calculation for RSAMD5. [GL #996]
-
-5216.	[bug]		Fetches-per-zone counter wasn't updated correctly
-			when doing qname minimization. [GL #992]
-
-5215.	[bug]		Change #5124 was incomplete; named could still
-			return FORMERR instead of SERVFAIL in some cases.
-			[GL #990]
-
-5214.	[bug]		win32: named now removes its lock file upon shutdown.
-			[GL #979]
-
-5213.	[bug]		win32: Eliminated a race which allowed named.exe running
-			as a service to be killed prematurely during shutdown.
-			[GL #978]
-
-5211.	[bug]		Allow out-of-zone additional data to be included
-			in authoritative responses if recursion is allowed
-			and "minimal-responses" is disabled.  This behavior
-			was inadvertently removed in change #4605. [GL #817]
-
-5210.	[bug]		When dnstap is enabled and recursion is not
-			available, incoming queries are now logged
-			as "auth". Previously, this depended on whether
-			recursion was requested by the client, not on
-			whether recursion was available. [GL #963]
-
-5209.	[bug]		When update-check-ksk is true, add_sigs was not
-			considering offline keys, leaving record sets signed
-			with the incorrect type key. [GL #763]
-
-5208.	[test]		Run valid rdata wire encodings through totext+fromtext
-			and tofmttext+fromtext methods to check these methods.
-			[GL #899]
-
-5207.	[test]		Check delv and dig TTL values. [GL #965]
-
-5206.	[bug]		Delv could print out bad TTLs. [GL #965]
-
-5205.	[bug]		Enforce that a DS hash exists. [GL #899]
-
-5204.	[test]		Check that dns_rdata_fromtext() produces a record that
-			will be accepted by dns_rdata_fromwire(). [GL #852]
-
-5203.	[bug]		Enforce whether key rdata exists or not in KEY,
-			DNSKEY, CDNSKEY and RKEY. [GL #899]
-
-5202.	[bug]		<dns/ecs.h> was missing ISC_LANG_ENDDECLS. [GL #976]
-
-5190.	[bug]		Ignore trust anchors using disabled algorithms.
-			[GL #806]
-
-	--- 9.14.1 released ---
-
-5201.	[bug]		Fix a possible deadlock in RPZ update code. [GL #973]
-
-5200.	[security]	tcp-clients settings could be exceeded in some cases,
-			which could lead to exhaustion of file descriptors.
-			(CVE-2018-5743) [GL #615]
-
-5199.	[security]	In certain configurations, named could crash
-			if nxdomain-redirect was in use and a redirected
-			query resulted in an NXDOMAIN from the cache.
-			(CVE-2019-6467) [GL #880]
-
-5198.	[bug]		If a fetch context was being shut down and, at the same
-			time, we returned from qname minimization, an INSIST
-			could be hit. [GL #966]
-
-5197.	[bug]		dig could die in best effort mode on multiple SIG(0)
-			records. Similarly on multiple OPT and multiple TSIG
-			records. [GL #920]
-
-5196.	[bug]		make install failed with --with-dlopen=no. [GL #955]
-
-5195.	[bug]		"allow-update" and "allow-update-forwarding" were
-			treated as configuration errors if used at the
-			options or view level. [GL #913]
-
-5194.	[bug]		Enforce non empty ZOMEMD hash. [GL #899]
-
-5193.	[bug]		EID and NIMLOC failed to do multi-line output
-			correctly. [GL #899]
-
-5189.	[cleanup]	Remove revoked root DNSKEY from bind.keys. [GL #945]
-
-5187.	[test]		Set time zone before running any tests in dnstap_test.
-			[GL #940]
-
-5186.	[cleanup]	More dnssec-keygen manual tidying. [GL !1678]
-
-5184.	[bug]		Missing unlocks in sdlz.c. [GL #936]
-
-5183.	[bug]		Reinitialize ECS data before reusing client
-			structures. [GL #881]
-
-	--- 9.14.0 released ---
-
-	--- 9.14.0rc3 released ---
-
-5182.	[bug]		Fix a high-load race/crash in handling of
-			isc_socket_close() in resolver. [GL #834]
-
-5180.	[bug]		delv now honors the operating system's preferred
-			ephemeral port range. [GL #925]
-
-5179.	[cleanup]	Replace some vague type declarations with the more
-			specific dns_secalg_t and dns_dsdigest_t.
-			Thanks to Tony Finch. [GL !1498]
-
-5178.	[bug]		Handle EDQUOT (disk quota) and ENOSPC (disk full)
-			errors when writing files. [GL #902]
-
-5177.	[func]		Add the ability to specify in named.conf whether a
-			response-policy zone's SOA record should be added
-			to the additional section (add-soa yes/no). [GL #865]
-
-5167.	[bug]		nxdomain-redirect could sometimes lookup the wrong
-			redirect name. [GL #892]
-
-	--- 9.14.0rc2 released ---
-
-5176.	[tests]		Remove a dependency on libxml in statschannel system
-			test. [GL #926]
-
-5175.	[bug]		Fixed a problem with file input in dnssec-keymgr,
-			dnssec-coverage and dnssec-checkds when using
-			python3. [GL #882]
-
-5174.	[doc]		Tidy dnssec-keygen manual. [GL !1557]
-
-5173.	[bug]		Fixed a race in socket code that could occur when
-			accept, send, or recv were called from an event
-			loop but the socket had been closed by another
-			thread. [RT #874]
-
-5172.	[bug]		nsupdate now honors the operating system's preferred
-			ephemeral port range. [GL #905]
-
-5171.	[func]		named plugins are now installed into a separate
-			directory.  Supplying a filename (a string without path
-			separators) in a "plugin" configuration stanza now
-			causes named to look for that plugin in that directory.
-			[GL #878]
-
-5170.	[test]		Added --with-dlz-filesystem to feature-test. [GL !1587]
-
-5169.	[bug]		The presence of certain types in an otherwise
-			empty node could cause a crash while processing a
-			type ANY query. [GL #901]
-
-	--- 9.14.0rc1 released ---
-
-5168.	[bug]		Do not crash on shutdown when RPZ fails to load.  Also,
-			keep previous version of the database if RPZ fails to
-			load. [GL #813]
-
-5165.	[contrib]	Removed SDB drivers from contrib; they're obsolete.
-			[GL #428]
-
-5164.	[bug]		Correct errno to result translation in dlz filesystem
-			modules. [GL #884]
-
-5163.	[cleanup]	Out-of-tree builds failed --enable-dnstap. [GL #836]
-
-5162.	[cleanup]	Improve dnssec-keymgr manual. Thanks to Tony Finch.
-			[GL !1518]
-
-5161.	[bug]		Do not require the SEP bit to be set for mirror zone
-			trust anchors. [GL #873]
-
-5160.	[contrib]	Added DNAME support to the DLZ LDAP schema. Also
-			fixed a compilation bug affecting several DLZ
-			modules. [GL #872]
-
-5159.	[bug]		dnssec-coverage was incorrectly ignoring
-			names specified on the command line without
-			trailing dots. [GL !1478]
-
-5158.	[protocol]	Add support for AMTRELAY and ZONEMD. [GL #867]
-
-5157.	[bug]		Nslookup now errors out if there are extra command
-			line arguments. [GL #207]
-
-5141.	[security]	Zone transfer controls for writable DLZ zones were
-			not effective as the allowzonexfr method was not being
-			called for such zones. (CVE-2019-6465) [GL #790]
-
-5118.	[security]	Named could crash if it is managing a key with
-			`managed-keys` and the authoritative zone is rolling
-			the key to an unsupported algorithm. (CVE-2018-5745)
-			[GL #780]
-
-5110.	[security]	Named leaked memory if there were multiple Key Tag
-			EDNS options present. (CVE-2018-5744) [GL #772]
-
-	--- 9.13.6 released ---
-
-5156.	[doc]		Extended and refined the section of the ARM describing
-			mirror zones. [GL #774]
-
 5155.	[func]		"named -V" now outputs the default paths to
 			named.conf, rndc.conf, bind.keys, and other
 			files used or created by named and other tools, so
@@ -416,7 +16,7 @@
 			- Zone signing and DNSKEY maintenance events are
 			  now logged to the "dnssec" category
 			- Messages are now logged when DNSSEC keys are
-			  published, activated, inactivated, deleted,
+			  pubished, activated, inactivated, deleted,
 			  or revoked.
 			[GL #714]

@@ -453,6 +53,8 @@
 			and "nsdname-enable" both now default to yes,
 			regardless of compile-time settings. [GL #824]

+5141.	[placeholder]
+
 5140.	[bug]		Don't immediately mark existing keys as inactive and
 			deleted when running dnssec-keymgr for the first
 			time. [GL #117]
@@ -523,6 +125,8 @@

 5119.	[placeholder]

+5118.	[placeholder]
+
 5117.	[placeholder]

 5116.	[bug]		Named/named-checkconf triggered a assertion when
@@ -543,6 +147,8 @@
 5111.	[bug]		Occluded DNSKEY records could make it into the
 			delegating NSEC/NSEC3 bitmap. [GL #742]

+5110.	[placeholder]
+
 5109.	[cleanup]	Remove support for RSAMD5 algorithm. [GL #628]

 	--- 9.13.5 released ---
@@ -621,8 +227,8 @@
 5091.	[func]		Two new global and per-view options min-cache-ttl
 			and min-ncache-ttl [GL #613]

-5090.	[bug]		dig and mdig failed to properly pre-parse dash value
-			pairs when value was a separate argument and started
+5090.	[bug]		dig and mdig failed to properly preparse dash value
+			pairs when value was a seperate argument and started
 			with a dash. [GL #584]

 5089.	[bug]		Restore localhost fallback in dig and host which is
@@ -688,7 +294,7 @@
 5072.	[bug]		Add unit tests for isc_buffer_copyregion() and fix its
 			behavior for auto-reallocated buffers. [GL #644]

-5071.	[bug]		Comparison of NXT records was broken. [GL #631]
+5071.	[bug]		Comparision of NXT records was broken. [GL #631]

 5070.	[bug]		Record types which support a empty rdata field were
 			not handling the empty rdata field case. [GL #638]
@@ -707,7 +313,7 @@

 5065.	[bug]		Only set IPV6_USE_MIN_MTU on IPv6. [GL #553]

-5064.	[test]		Initialize TZ environment variable before calling
+5064.	[test]		Initalize TZ environment variable before calling
 			dns_test_begin in dnstap_test. [GL #624]

 5063.	[test]		In statschannel test try a few times before failing
@@ -933,7 +539,7 @@
 5001.	[bug]		Fix refcount errors on error paths. [GL !563]

 5000.	[bug]		named_server_servestale() could leave the server in
-			exclusive mode if an error occurred. [GL #441]
+			exclusive mode if an error occured. [GL #441]

 4999.	[cleanup]	Remove custom printf implementation in lib/isc/print.c.
 			[GL #261]
@@ -1,5 +1,3 @@
-CONTRIBUTING
-
 BIND Source Access and Contributor Guidelines

 Feb 22, 2018
@@ -1,5 +1,3 @@
-HISTORY
-
 Functional enhancements from prior major releases of BIND 9

 BIND 9.11
@@ -433,11 +431,11 @@ BIND 9.4.0
  * Detect duplicates of UDP queries we are recursing on and drop them.
    New stats category "duplicates".
  * "USE INTERNAL MALLOC" is now runtime selectable.
-  * The lame cache is now done on a <qname,qclass,qtype> basis as some
-    servers only appear to be lame for certain query types.
+  * The lame cache is now done on a basis as some servers only appear to
+    be lame for certain query types.
  * Limit the number of recursive clients that can be waiting for a single
-    query (<qname,qtype,qclass>) to resolve. New options clients-per-query
-    and max-clients-per-query.
+    query () to resolve. New options clients-per-query and
+    max-clients-per-query.
  * dig: report the number of extra bytes still left in the packet after
    processing all the records.
  * Support for IPSECKEY rdata type.
@@ -97,27 +97,27 @@ test-force:
 	exit $$status

 README: README.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="README" -f markdown-smart -t html README.md | \
+	${PANDOC} --email-obfuscation=none -s -t html README.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@

 HISTORY: HISTORY.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="HISTORY" -f markdown-smart -t html HISTORY.md | \
+	${PANDOC} --email-obfuscation=none -s -t html HISTORY.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@

 OPTIONS: OPTIONS.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="OPTIONS" -f markdown-smart -t html OPTIONS.md | \
+	${PANDOC} --email-obfuscation=none -s -t html OPTIONS.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@

 CONTRIBUTING: CONTRIBUTING.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="CONTRIBUTING" -f markdown-smart -t html CONTRIBUTING.md | \
+	${PANDOC} --email-obfuscation=none -s -t html CONTRIBUTING.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@

 PLATFORMS: PLATFORMS.md
-	${PANDOC} --email-obfuscation=none -s --metadata title="PLATFORMS" -f markdown-smart -t html PLATFORMS.md | \
+	${PANDOC} --email-obfuscation=none -s -t html PLATFORMS.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@

@@ -1,12 +1,10 @@
-OPTIONS
-
 Setting the STD_CDEFINES environment variable before running configure can
 be used to enable certain compile-time options that are not explicitly
 defined in configure.

 Some of these settings are:

-         Setting                            Description
+Setting                   Description
                          Overwrite memory with tag values when allocating
 -DISC_MEM_DEFAULTFILL=1   or freeing it; this impairs performance but
                          makes debugging of memory problems easier.
@@ -1,5 +1,3 @@
-PLATFORMS
-
 Supported platforms

 In general, this version of BIND will build and run on any POSIX-compliant
@@ -15,7 +13,7 @@ offer support on a "best effort" basis for some.

 Regularly tested platforms

-As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
+As of Jan 2019, BIND 9.13 is fully supported and regularly tested on the
 following systems:

  * Debian 8, 9, 10
@@ -53,7 +51,7 @@ Server 2012 R2, none of these are tested regularly by ISC.

 Unsupported platforms

-These are platforms on which BIND 9.14 is known not to build or run:
+These are platforms on which BIND 9.13 is known not to build or run:

  * Platforms without at least OpenSSL 1.0.2
  * Windows 10 / x86
@@ -66,10 +64,27 @@ These are platforms on which BIND 9.14 is known not to build or run:

 Platform quirks

-NetBSD 6 i386
+ARM

-The i386 build of NetBSD requires the libatomic library, available from
-the gcc5-libs package. Because this library is in a non-standard path, its
-location must be specified in the configure command line:
+If the compilation ends with following error:

-LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
+Error: selected processor does not support `yield' in ARM mode
+
+You will need to set -march compiler option to native, so the compiler
+recognizes yield assembler instruction. The proper way to set -march=
+native would be to put it into CFLAGS, e.g. run ./configure like this:
+CFLAGS="-march=native -Os -g" ./configure plus your usual options.
+
+If that doesn't work, you can enforce the minimum CPU and FPU (taken from
+Debian armhf documentation):
+
+  * The lowest worthwhile CPU implementation is Armv7-A, therefore the
+    recommended build option is -march=armv7-a.
+
+  * FPU should be set at VFPv3-D16 as they represent the minimum
+    specification of the processors to support here, therefore the
+    recommended build option is -mfpu=vfpv3-d16.
+
+The configure command should look like this:
+
+CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
@@ -23,7 +23,7 @@ offer support on a "best effort" basis for some.

 ### Regularly tested platforms

-As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
+As of Jan 2019, BIND 9.13 is fully supported and regularly tested on the
 following systems:

 * Debian 8, 9, 10
@@ -60,7 +60,7 @@ Server 2012 R2, none of these are tested regularly by ISC.

 ## Unsupported platforms

-These are platforms on which BIND 9.14 is known *not* to build or run:
+These are platforms on which BIND 9.13 is known *not* to build or run:

 * Platforms without at least OpenSSL 1.0.2
 * Windows 10 / x86
@@ -72,12 +72,31 @@ These are platforms on which BIND 9.14 is known *not* to build or run:

 ## Platform quirks

-### NetBSD 6 i386
+### ARM

-The i386 build of NetBSD requires the `libatomic` library, available from
-the `gcc5-libs` package.  Because this library is in a non-standard path,
-its location must be specified in the `configure` command line:
+If the compilation ends with following error:

 ```
-LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
+Error: selected processor does not support `yield' in ARM mode
+```
+
+You will need to set `-march` compiler option to `native`, so the compiler
+recognizes `yield` assembler instruction.  The proper way to set `-march=native`
+would be to put it into `CFLAGS`, e.g. run `./configure` like this:
+`CFLAGS="-march=native -Os -g" ./configure` plus your usual options.
+
+If that doesn't work, you can enforce the minimum CPU and FPU (taken from Debian
+armhf documentation):
+
+* The lowest worthwhile CPU implementation is Armv7-A, therefore the recommended
+  build option is `-march=armv7-a`.
+
+* FPU should be set at VFPv3-D16 as they represent the minimum specification of
+  the processors to support here, therefore the recommended build option is
+  `-mfpu=vfpv3-d16`.
+
+The configure command should look like this:
+
+```
+CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
 ```
@@ -1,5 +1,3 @@
-README
-
 BIND 9

 Contents
@@ -7,7 +5,7 @@ Contents
 1. Introduction
 2. Reporting bugs and getting help
 3. Contributing to BIND
- 4. BIND 9.14 features
+ 4. BIND 9.13 features
 5. Building BIND
 6. macOS
 7. Dependencies
@@ -39,7 +37,7 @@ in versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a
 501(c)(3) public benefit corporation dedicated to providing software and
 services in support of the Internet infrastructure, developed BIND 9 and
 is responsible for its ongoing maintenance and improvement. BIND is open
-source software licensed under the terms of the Mozilla Public License,
+source software licenced under the terms of the Mozilla Public License,
 version 2.0.

 For a summary of features introduced in past major releases of BIND, see
@@ -71,9 +69,6 @@ If the bug you are reporting is a potential security issue, such as an
 assertion failure or other crash in named, please do NOT use GitLab to
 report it. Instead, please send mail to security-officer@isc.org.

-For a general overview of ISC security policies, read the Knowledge Base
-article at https://kb.isc.org/docs/aa-00861.
-
 Professional support and training for BIND are available from ISC at
 https://www.isc.org/support.

@@ -93,7 +88,7 @@ Information for BIND contributors can be found in the following files: -
 General information: CONTRIBUTING.md - BIND 9 code style: doc/dev/style.md
 - BIND architecture and developer guide: doc/dev/dev.md

-Patches for BIND may be submitted as merge requests in the ISC GitLab
+Patches for BIND may be submitted as Merge Requests in the ISC GitLab
 server at at https://gitlab.isc.org/isc-projects/bind9/merge_requests.

 By default, external contributors don't have ability to fork BIND in the
@@ -105,19 +100,17 @@ If you prefer, you may also submit code by opening a GitLab Issue and
 including your patch as an attachment, preferably generated by git
 format-patch.

-BIND 9.14 features
+BIND 9.13 features

-BIND 9.14.0 is the first release from a new stable branch of BIND 9,
-incorporating all changes from the 9.13 development branch, updating the
-most recent stable branch, 9.12. These changes include:
+BIND 9.13 is the newest development branch of BIND 9. It includes a number
+of changes from BIND 9.12 and earlier releases. New features include:

  * A new "plugin" mechanism has been added to allow query functionality
    to be extended using dynamically loadable libraries. The "filter-aaaa"
    feature has been removed from named and is now implemented as a
    plugin.
+  * Socket and task code has been refactored to improve performance.
  * QNAME minimization, as described in RFC 7816, is now supported.
-  * Socket and task code has been refactored to improve performance on
-    most modern machines.
  * "Root key sentinel" support, enabling validating resolvers to indicate
    via a special query which trust anchors are configured for the root
    zone.
@@ -130,8 +123,6 @@ most recent stable branch, 9.12. These changes include:
    which DNSSEC validation should not be performed.
  * The default value of "dnssec-validation" is now "auto".
  * IDNA2008 is now supported when linking with libidn2.
-  * "named -V" now outputs the default paths for files used by named and
-    other tools.

 In addition, workarounds that were formerly in place to enable resolution
 of domains whose authoritative servers did not respond to EDNS queries
@@ -145,49 +136,15 @@ is now mandatory: building BIND without DNSSEC is no longer supported.
 Special code to support certain legacy operating systems has also been
 removed; see the file PLATFORMS.md for details of supported platforms. In
 addition to OpenSSL, BIND now requires support for IPv6, threads, and
-standard atomic operations provided by the C compiler. Non-threaded builds
-are no longer supported.
-
-BIND 9.14.1
-
-BIND 9.14.1 is a maintenance release, and addresses security
-vulnerabilities disclosed in CVE-2018-5743 and CVE-2019-6467.
-
-BIND 9.14.2
-
-BIND 9.14.2 is a maintenance release.
-
-BIND 9.14.3
-
-BIND 9.14.3 is a maintenance release, and addresses the security
-vulnerability disclosed in CVE-2019-6471.
-
-BIND 9.14.4
-
-BIND 9.14.4 is a maintenance release, and also adds support for the new
-MaxMind GeoIP2 geolocation API when built with configure --with-geoip2.
-
-BIND 9.14.5
-
-BIND 9.14.5 is a maintenance release.
-
-BIND 9.14.6
-
-BIND 9.14.6 is a maintenance release.
-
-BIND 9.14.7
-
-BIND 9.14.7 is a maintenance release, and also addresses the security
-vulnerabilities disclosed in CVE-2019-6475 and CVE-2019-6476.
+standard atomic operations provided by the C compiler.

 Building BIND

 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
 basic POSIX support, and a 64-bit integer type. Successful builds have
-been observed on many versions of Linux and UNIX, including RHEL/CentOS,
-Fedora, Debian, Ubuntu, SLES, openSUSE, Slackware, Alpine, FreeBSD,
-NetBSD, OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE, HP-UX, and
-OpenWRT.
+been observed on many versions of Linux and UNIX, including RedHat,
+Fedora, Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS
+X, Solaris, HP-UX, and OpenWRT.

 BIND requires a cryptography provider library such as OpenSSL or a
 hardware service module supporting PKCS#11. On Linux, BIND requires the
@@ -196,8 +153,8 @@ overridden by disabling capability support at compile time. See
 Compile-time options below for details on other libraries that may be
 required to support optional features.

-BIND is also available for Windows Server 2008 and higher. See win32utils/
-build.txt for details on building for Windows systems.
+BIND is also available for Windows 2008 and higher. See win32utils/
+readme1st.txt for details on building for Windows systems.

 To build on a UNIX or Linux system, use:

@@ -210,7 +167,7 @@ make depend. If you're using Emacs, you might find make tags helpful.
 Several environment variables that can be set before running configure
 will affect compilation:

-   Variable                            Description
+Variable       Description
 CC             The C compiler to use. configure tries to figure out the
               right one for supported systems.
               C compiler flags. Defaults to include -g and/or -O2 as
@@ -225,23 +182,25 @@ STD_CDEFINES   Defaults to empty string. For a list of possible settings,
 LDFLAGS        Linker flags. Defaults to empty string.
 BUILD_CC       Needed when cross-compiling: the native C compiler to use
               when building for the target system.
-BUILD_CFLAGS   CFLAGS for the target system during cross-compiling.
-BUILD_CPPFLAGS CPPFLAGS for the target system during cross-compiling.
-BUILD_LDFLAGS  LDFLAGS for the target system during cross-compiling.
-BUILD_LIBS     LIBS for the target system during cross-compiling.
+BUILD_CFLAGS   Optional, used for cross-compiling
+BUILD_CPPFLAGS
+BUILD_LDFLAGS
+BUILD_LIBS

 macOS

 Building on macOS assumes that the "Command Tools for Xcode" is installed.
 This can be downloaded from https://developer.apple.com/download/more/ or
-if you have Xcode already installed you can run xcode-select --install.
+if you have Xcode already installed you can run "xcode-select --install".
+This will add /usr/include to the system and install the compiler and
+other tools so that they can be easily found.

 Dependencies

 Portions of BIND that are written in Python, including dnssec-keymgr,
 dnssec-coverage, dnssec-checkds, and some of the system tests, require the
-argparse and ply modules to be available. argparse is a standard module as
-of Python 2.7 and Python 3.2. ply is available from https://
+'argparse' and 'ply' modules to be available. 'argparse' is a standard
+module as of Python 2.7 and Python 3.2. 'ply' is available from https://
 pypi.python.org/pypi/ply.

 Compile-time options
@@ -260,12 +219,9 @@ operations, specify the path to the PKCS#11 provider library using
 --with-pkcs11=<PREFIX>, and configure BIND with --enable-native-pkcs11.

 To support the HTTP statistics channel, the server must be linked with at
-least one of the following libraries: libxml2 http://xmlsoft.org or json-c
-https://github.com/json-c/json-c. If these are installed at a nonstandard
-location, then:
-
-  * for libxml2, specify the prefix using --with-libxml2=/prefix,
-  * for json-c, adjust PKG_CONFIG_PATH.
+least one of the following: libxml2 http://xmlsoft.org or json-c https://
+github.com/json-c. If these are installed at a nonstandard location,
+specify the prefix using --with-libxml2=/prefix or --with-libjson=/prefix.

 To support compression on the HTTP statistics channel, the server must be
 linked against libzlib. If this is installed in a nonstandard location,
@@ -294,8 +250,8 @@ smaller systems.

 On Linux, process capabilities are managed in user space using the libcap
 library, which can be installed on most Linux systems via the libcap-dev
-or libcap-devel package. Process capability support can also be disabled
-by configuring with --disable-linux-caps.
+or libcap-devel module. Process capability support can also be disabled by
+configuring with --disable-linux-caps.

 On some platforms it is necessary to explicitly request large file support
 to handle files bigger than 2GB. This can be done by using
@@ -332,7 +288,7 @@ ifconfig.sh up as root.

 Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
 and will be skipped if these are not available. Some tests require Python
-and the dnspython module and will be skipped if these are not available.
+and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.

 Unit tests are implemented using the CMocka unit testing framework. To
@@ -343,7 +299,7 @@ tests can be run via make test or make unit.
 Documentation

 The BIND 9 Administrator Reference Manual is included with the source
-distribution, in DocBook XML, HTML, and PDF format, in the doc/arm
+distribution, in DocBook XML, HTML and PDF format, in the doc/arm
 directory.

 Some of the programs in the BIND 9 distribution have man pages in their
@@ -363,7 +319,7 @@ development BIND 9 is included in the file CHANGES, with the most recent
 changes listed first. Change notes include tags indicating the category of
 the change that was made; these categories are:

-   Category                            Description
+Category       Description
 [func]         New feature
 [bug]          General bug fix
 [security]     Fix for a significant security flaw
@@ -391,46 +347,26 @@ releases (i.e., those with version numbers ending in zero). Some new
 functionality may be backported to older releases on a case-by-case basis.
 All other change types may be applied to all currently-supported releases.

-Bug report identifiers
-
-Most notes in the CHANGES file include a reference to a bug report or
-issue number. Prior to 2018, these were usually of the form [RT #NNN] and
-referred to entries in the "bind9-bugs" RT database, which was not open to
-the public. More recent entries use the form [GL #NNN] or, less often, [GL
-!NNN], which, respectively, refer to issues or merge requests in the
-GitLab database. Most of these are publicly readable, unless they include
-information which is confidential or security sensitive.
-
-To look up a GitLab issue by its number, use the URL https://
-gitlab.isc.org/isc-projects/bind9/issues/NNN. To look up a merge request,
-use https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN.
-
-In rare cases, an issue or merge request number may be followed with the
-letter "P". This indicates that the information is in the private ISC
-GitLab instance, which is not visible to the public.
-
 Acknowledgments

  * The original development of BIND 9 was underwritten by the following
    organizations:

-      Sun Microsystems, Inc.
-      Hewlett Packard
-      Compaq Computer Corporation
-      IBM
-      Process Software Corporation
-      Silicon Graphics, Inc.
-      Network Associates, Inc.
-      U.S. Defense Information Systems Agency
-      USENIX Association
-      Stichting NLnet - NLnet Foundation
-      Nominum, Inc.
+    Sun Microsystems, Inc.
+    Hewlett Packard
+    Compaq Computer Corporation
+    IBM
+    Process Software Corporation
+    Silicon Graphics, Inc.
+    Network Associates, Inc.
+    U.S. Defense Information Systems Agency
+    USENIX Association
+    Stichting NLnet - NLnet Foundation
+    Nominum, Inc.

  * This product includes software developed by the OpenSSL Project for
    use in the OpenSSL Toolkit. http://www.OpenSSL.org/
-
  * This product includes cryptographic software written by Eric Young
    (eay@cryptsoft.com)
-
  * This product includes software written by Tim Hudson
    (tjh@cryptsoft.com)
@@ -15,7 +15,7 @@
 1. [Introduction](#intro)
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
-1. [BIND 9.14 features](#features)
+1. [BIND 9.13 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
 1. [Dependencies](#dependencies)
@@ -48,7 +48,7 @@ used in versions 4 and 8.  Internet Systems Consortium
 corporation dedicated to providing software and services in support of the
 Internet infrastructure, developed BIND 9 and is responsible for its
 ongoing maintenance and improvement.  BIND is open source software
-licensed under the terms of the Mozilla Public License, version 2.0.
+licenced under the terms of the Mozilla Public License, version 2.0.

 For a summary of features introduced in past major releases of BIND,
 see the file [HISTORY](HISTORY.md).
@@ -82,9 +82,6 @@ assertion failure or other crash in `named`, please do *NOT* use GitLab to
 report it. Instead, please send mail to
 [security-officer@isc.org](mailto:security-officer@isc.org).

-For a general overview of ISC security policies, read the Knowledge Base
-article at [https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
-
 Professional support and training for BIND are available from
 ISC at [https://www.isc.org/support](https://www.isc.org/support).

@@ -106,7 +103,7 @@ Information for BIND contributors can be found in the following files:
 - BIND architecture and developer guide: [doc/dev/dev.md](doc/dev/dev.md)

 Patches for BIND may be submitted as
-[merge requests](https://gitlab.isc.org/isc-projects/bind9/merge_requests)
+[Merge Requests](https://gitlab.isc.org/isc-projects/bind9/merge_requests)
 in the [ISC GitLab server](https://gitlab.isc.org) at
 at [https://gitlab.isc.org/isc-projects/bind9/merge_requests](https://gitlab.isc.org/isc-projects/bind9/merge_requests).

@@ -120,18 +117,17 @@ If you prefer, you may also submit code by opening a
 including your patch as an attachment, preferably generated by
 `git format-patch`.

-### <a name="features"/> BIND 9.14 features
+### <a name="features"/> BIND 9.13 features

-BIND 9.14.0 is the first release from a new stable branch of BIND 9,
-incorporating all changes from the 9.13 development branch, updating
-the most recent stable branch, 9.12.  These changes include:
+BIND 9.13 is the newest development branch of BIND 9. It includes a
+number of changes from BIND 9.12 and earlier releases.  New features
+include:

 * A new "plugin" mechanism has been added to allow query functionality
  to be extended using dynamically loadable libraries. The "filter-aaaa"
  feature has been removed from named and is now implemented as a plugin.
+* Socket and task code has been refactored to improve performance.
 * QNAME minimization, as described in RFC 7816, is now supported.
-* Socket and task code has been refactored to improve performance on most
-  modern machines.
 * "Root key sentinel" support, enabling validating resolvers to indicate
  via a special query which trust anchors are configured for the root zone.
 * Secondary zones can now be configured as "mirror" zones; their contents
@@ -143,8 +139,6 @@ the most recent stable branch, 9.12.  These changes include:
  DNSSEC validation should not be performed.
 * The default value of "dnssec-validation" is now "auto".
 * IDNA2008 is now supported when linking with `libidn2`.
-* "named -V" now outputs the default paths for files used by named
-  and other tools.

 In addition, workarounds that were formerly in place to enable resolution
 of domains whose authoritative servers did not respond to EDNS queries
@@ -161,48 +155,15 @@ Special code to support certain legacy operating systems has also
 been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
 of supported platforms. In addition to OpenSSL, BIND now requires
 support for IPv6, threads, and standard atomic operations provided
-by the C compiler. Non-threaded builds are no longer supported.
-
-#### BIND 9.14.1
-
-BIND 9.14.1 is a maintenance release, and addresses security
-vulnerabilities disclosed in CVE-2018-5743 and CVE-2019-6467.
-
-#### BIND 9.14.2
-
-BIND 9.14.2 is a maintenance release.
-
-#### BIND 9.14.3
-
-BIND 9.14.3 is a maintenance release, and addresses the security
-vulnerability disclosed in CVE-2019-6471.
-
-#### BIND 9.14.4
-
-BIND 9.14.4 is a maintenance release, and also adds support for
-the new MaxMind GeoIP2 geolocation API when built with
-`configure --with-geoip2`.
-
-#### BIND 9.14.5
-
-BIND 9.14.5 is a maintenance release.
-
-#### BIND 9.14.6
-
-BIND 9.14.6 is a maintenance release.
-
-#### BIND 9.14.7
-
-BIND 9.14.7 is a maintenance release, and also addresses the security
-vulnerabilities disclosed in CVE-2019-6475 and CVE-2019-6476.
+by the C compiler.

 ### <a name="build"/> Building BIND

 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
 basic POSIX support, and a 64-bit integer type. Successful builds have been
-observed on many versions of Linux and UNIX, including RHEL/CentOS, Fedora,
-Debian, Ubuntu, SLES, openSUSE, Slackware, Alpine, FreeBSD, NetBSD,
-OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
+observed on many versions of Linux and UNIX, including RedHat, Fedora,
+Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X,
+Solaris, HP-UX, and OpenWRT.

 BIND requires a cryptography provider library such as OpenSSL or a
 hardware service module supporting PKCS#11. On Linux, BIND requires
@@ -211,8 +172,8 @@ can be overridden by disabling capability support at compile time.
 See [Compile-time options](#opts) below for details on other libraries
 that may be required to support optional features.

-BIND is also available for Windows Server 2008 and higher.  See
-`win32utils/build.txt` for details on building for Windows
+BIND is also available for Windows 2008 and higher.  See
+`win32utils/readme1st.txt` for details on building for Windows
 systems.

 To build on a UNIX or Linux system, use:
@@ -234,24 +195,26 @@ affect compilation:
 |`STD_CDEFINES`|Any additional preprocessor symbols you want defined.  Defaults to empty string. For a list of possible settings, see the file [OPTIONS](OPTIONS.md).|
 |`LDFLAGS`|Linker flags. Defaults to empty string.|
 |`BUILD_CC`|Needed when cross-compiling: the native C compiler to use when building for the target system.|
-|`BUILD_CFLAGS`|`CFLAGS` for the target system during cross-compiling.|
-|`BUILD_CPPFLAGS`|`CPPFLAGS` for the target system during cross-compiling.|
-|`BUILD_LDFLAGS`|`LDFLAGS` for the target system during cross-compiling.|
-|`BUILD_LIBS`|`LIBS` for the target system during cross-compiling.|
+|`BUILD_CFLAGS`|Optional, used for cross-compiling|
+|`BUILD_CPPFLAGS`||
+|`BUILD_LDFLAGS`||
+|`BUILD_LIBS`||

 #### <a name="macos"> macOS

 Building on macOS assumes that the "Command Tools for Xcode" is installed.
-This can be downloaded from [https://developer.apple.com/download/more/](https://developer.apple.com/download/more/)
-or if you have Xcode already installed you can run `xcode-select --install`.
+This can be downloaded from https://developer.apple.com/download/more/
+or if you have Xcode already installed you can run "xcode-select --install".
+This will add /usr/include to the system and install the compiler and other
+tools so that they can be easily found.

 ### <a name="dependencies"/> Dependencies

 Portions of BIND that are written in Python, including
 `dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
-system tests, require the `argparse` and `ply` modules to be available.
-`argparse` is a standard module as of Python 2.7 and Python 3.2.
-`ply` is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
+system tests, require the 'argparse' and 'ply' modules to be available.
+'argparse' is a standard module as of Python 2.7 and Python 3.2.
+'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).

 #### <a name="opts"/> Compile-time options

@@ -269,16 +232,14 @@ path to the PKCS#11 provider library using `--with-pkcs11=<PREFIX>`, and
 configure BIND with `--enable-native-pkcs11`.

 To support the HTTP statistics channel, the server must be linked with at
-least one of the following libraries: `libxml2`
-[http://xmlsoft.org](http://xmlsoft.org) or `json-c`
-[https://github.com/json-c/json-c](https://github.com/json-c/json-c).
-If these are installed at a nonstandard location, then:
-
-* for `libxml2`, specify the prefix using `--with-libxml2=/prefix`,
-* for `json-c`, adjust `PKG_CONFIG_PATH`.
+least one of the following: libxml2
+[http://xmlsoft.org](http://xmlsoft.org) or json-c
+[https://github.com/json-c](https://github.com/json-c).  If these are
+installed at a nonstandard location, specify the prefix using
+`--with-libxml2=/prefix` or `--with-libjson=/prefix`.

 To support compression on the HTTP statistics channel, the server must be
-linked against `libzlib`.  If this is installed in a nonstandard location,
+linked against libzlib.  If this is installed in a nonstandard location,
 specify the prefix using `--with-zlib=/prefix`.

 To support storing configuration data for runtime-added zones in an LMDB
@@ -290,9 +251,9 @@ libGeoIP. This is not turned on by default; BIND must be configured with
 `--with-geoip`. If the library is installed in a nonstandard location,
 specify the prefix using `--with-geoip=/prefix`.

-For DNSTAP packet logging, you must have installed `libfstrm`
+For DNSTAP packet logging, you must have installed libfstrm
 [https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
-and `libprotobuf-c`
+and libprotobuf-c
 [https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
 and BIND must be configured with `--enable-dnstap`.

@@ -305,7 +266,7 @@ performance on smaller systems.

 On Linux, process capabilities are managed in user space using
 the `libcap` library, which can be installed on most Linux systems via
-the `libcap-dev` or `libcap-devel` package. Process capability support can
+the `libcap-dev` or `libcap-devel` module. Process capability support can
 also be disabled by configuring with `--disable-linux-caps`.

 On some platforms it is necessary to explicitly request large file support
@@ -341,21 +302,20 @@ multiple servers to run locally and communicate with one another).  These
 IP addresses can be configured by running the command
 `bin/tests/system/ifconfig.sh up` as root.

-Some tests require Perl and the `Net::DNS` and/or `IO::Socket::INET6` modules,
+Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
 and will be skipped if these are not available. Some tests require Python
-and the `dnspython` module and will be skipped if these are not available.
+and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.

-Unit tests are implemented using the [CMocka unit testing framework](https://cmocka.org/).
+Unit tests are implemented using the CMocka unit testing framework.
 To build them, use `configure --with-cmocka`. Execution of tests is done
-by the [Kyua test execution engine](https://github.com/jmmv/kyua); if the
-`kyua` command is available, then unit tests can be run via `make test`
-or `make unit`.
+by the Kyua test execution engine; if the `kyua` command is available,
+then unit tests can be run via `make test` or `make unit`.

 ### <a name="doc"/> Documentation

 The *BIND 9 Administrator Reference Manual* is included with the source
-distribution, in DocBook XML, HTML, and PDF format, in the `doc/arm`
+distribution, in DocBook XML, HTML and PDF format, in the `doc/arm`
 directory.

 Some of the programs in the BIND 9 distribution have man pages in their
@@ -398,25 +358,6 @@ releases (i.e., those with version numbers ending in zero).  Some new
 functionality may be backported to older releases on a case-by-case basis.
 All other change types may be applied to all currently-supported releases.

-#### Bug report identifiers
-
-Most notes in the CHANGES file include a reference to a bug report or
-issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
-and referred to entries in the "bind9-bugs" RT database, which was not open
-to the public. More recent entries use the form `[GL #NNN]` or, less often,
-`[GL !NNN]`, which, respectively, refer to issues or merge requests in the
-GitLab database. Most of these are publicly readable, unless they include
-information which is confidential or security sensitive.
-
-To look up a GitLab issue by its number, use the URL
-[https://gitlab.isc.org/isc-projects/bind9/issues/NNN](https://gitlab.isc.org/isc-projects/bind9/issues).
-To look up a merge request, use
-[https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN](https://gitlab.isc.org/isc-projects/bind9/merge_requests).
-
-In rare cases, an issue or merge request number may be followed with the
-letter "P". This indicates that the information is in the private ISC
-GitLab instance, which is not visible to the public.
-
 ### <a name="ack"/> Acknowledgments

 * The original development of BIND 9 was underwritten by the
@@ -291,8 +291,6 @@ AS_VAR_IF([$1], [""], [$5], [$4])dnl
 m4_include([m4/ax_check_openssl.m4])
 m4_include([m4/ax_posix_shell.m4])
 m4_include([m4/ax_pthread.m4])
-m4_include([m4/ax_restore_flags.m4])
-m4_include([m4/ax_save_flags.m4])
 m4_include([m4/libtool.m4])
 m4_include([m4/ltoptions.m4])
 m4_include([m4/ltsugar.m4])
@@ -21,7 +21,7 @@ CINCLUDES =	${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES}
 CDEFINES = 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =

-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -143,5 +143,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -63,7 +63,7 @@ usage(void) ISC_PLATFORM_NORETURN_POST;

 static void
 usage(void) {
-	fprintf(stderr, "usage: %s [-chjlvz] [-p [-x]] [-t directory] "
+	fprintf(stderr, "usage: %s [-hjlvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n", program);
 	exit(1);
 }
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -325,5 +325,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{03A96113-CB14-43AA-AEB2-48950E3915C5}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>checkconf</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -17,21 +17,18 @@
    <ProjectGuid>{2C1F7096-C5B5-48D4-846F-A7ACA454335D}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>checktool</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{66028555-7DD5-4016-B601-9EF9A1EE8BFA}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>checkzone</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -65,15 +62,15 @@
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
      <SubSystem>Console</SubSystem>
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PostBuildEvent>
      <Command>cd ..\..\..\Build\$(Configuration)
@@ -98,7 +95,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
@@ -107,8 +104,8 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
      <EnableCOMDATFolding>true</EnableCOMDATFolding>
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
    </Link>
    <PostBuildEvent>
@@ -29,7 +29,7 @@ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@

 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -144,5 +144,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -206,5 +206,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{64964B03-4815-41F0-9057-E766A94AF197}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>confgentool</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{1EA4FC64-F33B-4A50-970A-EA052BBE9CF1}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>ddnsconfgen</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{1E2C1635-3093-4D59-80E7-4743AC10F22F}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>rndcconfgen</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -23,7 +23,7 @@ CDEFINES =	-DVERSION=\"${VERSION}\" \
 CWARNINGS =

 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
 ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
 IRSLIBS =	../../lib/irs/libirs.@A@
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -437,5 +437,5 @@ RFC5155\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{BE172EFE-C1DC-4812-BFB9-8C5F8ADB7E9F}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>delv</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -25,7 +25,7 @@ CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =

 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -361,20 +361,14 @@ Display [do not display] the CLASS when printing the record\&.
 .PP
 \fB+[no]cmd\fR
 .RS 4
-Toggles the printing of the initial comment in the output, identifying the version of
+Toggles the printing of the initial comment in the output identifying the version of
 \fBdig\fR
-and the query options that have been applied\&. This option always has global effect; it cannot be set globally and then overridden on a per\-lookup basis\&. The default is to print this comment\&.
+and the query options that have been applied\&. This comment is printed by default\&.
 .RE
 .PP
 \fB+[no]comments\fR
 .RS 4
-Toggles the display of some comment lines in the output, containing information about the packet header and OPT pseudosection, and the names of the response section\&. The default is to print these comments\&.
-.sp
-Other types of comments in the output are not affected by this option, but can be controlled using other command line switches\&. These include
-\fB+[no]cmd\fR,
-\fB+[no]question\fR,
-\fB+[no]stats\fR, and
-\fB+[no]rrcomments\fR\&.
+Toggle the display of comment lines in the output\&. The default is to print comments\&.
 .RE
 .PP
 \fB+[no]cookie\fR\fB[=####]\fR
@@ -567,12 +561,12 @@ would cause a 48\-byte query to be padded to 64 bytes\&. The default block size
 .PP
 \fB+[no]qr\fR
 .RS 4
-Toggles the display of the query message as it is sent\&. By default, the query is not printed\&.
+Print [do not print] the query as it is sent\&. By default, the query is not printed\&.
 .RE
 .PP
 \fB+[no]question\fR
 .RS 4
-Toggles the display of the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
+Print [do not print] the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
 .RE
 .PP
 \fB+[no]raflag\fR
@@ -590,11 +584,11 @@ A synonym for
 .RS 4
 Toggle the setting of the RD (recursion desired) bit in the query\&. This bit is set by default, which means
 \fBdig\fR
-normally sends recursive queries\&. Recursion is automatically disabled when using the
+normally sends recursive queries\&. Recursion is automatically disabled when the
 \fI+nssearch\fR
-option, and when using
+or
 \fI+trace\fR
-except for an initial recursive query to get the list of root servers\&.
+query options are used\&.
 .RE
 .PP
 \fB+retry=T\fR
@@ -625,7 +619,7 @@ determines if the name will be treated as relative or not and hence whether a se
 .PP
 \fB+[no]short\fR
 .RS 4
-Provide a terse answer\&. The default is to print the answer in a verbose form\&. This option always has global effect; it cannot be set globally and then overridden on a per\-lookup basis\&.
+Provide a terse answer\&. The default is to print the answer in a verbose form\&.
 .RE
 .PP
 \fB+[no]showsearch\fR
@@ -655,7 +649,7 @@ causes fields not to be split at all\&. The default is 56 characters, or 44 char
 .PP
 \fB+[no]stats\fR
 .RS 4
-Toggles the printing of statistics: when the query was made, the size of the reply and so on\&. The default behavior is to print the query statistics as a comment after each lookup\&.
+This query option toggles the printing of statistics: when the query was made, the size of the reply and so on\&. The default behavior is to print the query statistics\&.
 .RE
 .PP
 \fB+[no]subnet=addr[/prefix\-length]\fR
@@ -830,5 +824,5 @@ There are probably too many query options\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -175,13 +175,11 @@ help(void) {
 "                 +bufsize=###        (Set EDNS0 Max UDP packet size)\n"
 "                 +[no]cdflag         (Set checking disabled flag in query)\n"
 "                 +[no]class          (Control display of class in records)\n"
-"                 +[no]cmd            (Control display of command line -\n"
-"                                      global option)\n"
-"                 +[no]comments       (Control display of packet header\n"
-"                                      and section name comments)\n"
+"                 +[no]cmd            (Control display of command line)\n"
+"                 +[no]comments       (Control display of comment lines)\n"
 "                 +[no]cookie         (Add a COOKIE option to the request)\n"
-"                 +[no]crypto         (Control display of cryptographic\n"
-"                                      fields in records)\n"
+"                 +[no]crypto         (Control display of cryptographic "
+				       "fields in records)\n"
 "                 +[no]defname        (Use search list (+[no]search))\n"
 "                 +[no]dnssec         (Request DNSSEC records)\n"
 "                 +domain=###         (Set default domainname)\n"
@@ -197,13 +195,11 @@ help(void) {
 "                 +[no]identify       (ID responders in short answers)\n"
 #ifdef HAVE_LIBIDN2
 "                 +[no]idnin          (Parse IDN names [default=on on tty])\n"
-"                 +[no]idnout         (Convert IDN response "
-					"[default=on on tty])\n"
+"                 +[no]idnout         (Convert IDN response [default=on on tty])\n"
 #endif
 "                 +[no]ignore         (Don't revert to TCP for TC responses.)\n"
 "                 +[no]keepalive      (Request EDNS TCP keepalive)\n"
-"                 +[no]keepopen       (Keep the TCP socket open between "
-					"queries)\n"
+"                 +[no]keepopen       (Keep the TCP socket open between queries)\n"
 "                 +[no]mapped         (Allow mapped IPv4 over IPv6)\n"
 "                 +[no]multiline      (Print records in an expanded format)\n"
 "                 +ndots=###          (Set search NDOTS value)\n"
@@ -222,7 +218,7 @@ help(void) {
 					"comments)\n"
 "                 +[no]search         (Set whether to use searchlist)\n"
 "                 +[no]short          (Display nothing except short\n"
-"                                      form of answers - global option)\n"
+"                                      form of answer)\n"
 "                 +[no]showsearch     (Search with intermediate results)\n"
 "                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
 "                 +[no]stats          (Control display of statistics)\n"
@@ -230,13 +226,11 @@ help(void) {
 "                 +[no]tcflag         (Set TC flag in query (+[no]tcflag))\n"
 "                 +[no]tcp            (TCP mode (+[no]vc))\n"
 "                 +timeout=###        (Set query timeout) [5]\n"
-"                 +[no]trace          (Trace delegation down from root "
-					"[+dnssec])\n"
+"                 +[no]trace          (Trace delegation down from root [+dnssec])\n"
 "                 +tries=###          (Set number of UDP attempts) [3]\n"
 "                 +[no]ttlid          (Control display of ttls in records)\n"
 "                 +[no]ttlunits       (Display TTLs in human-readable units)\n"
-"                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" "
-					"format)\n"
+"                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" format)\n"
 "                 +[no]vc             (TCP mode (+[no]tcp))\n"
 "                 +[no]zflag          (Set Z flag in query)\n"
 "        global d-opts and servers (before host name) affect all queries.\n"
@@ -508,9 +502,8 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	check_result(result, "dns_master_stylecreate");

 	if (query->lookup->cmdline[0] != 0) {
-		if (!short_form && printcmd) {
+		if (!short_form)
 			fputs(query->lookup->cmdline, stdout);
-		}
 		query->lookup->cmdline[0]=0;
 	}
 	debug("printmessage(%s %s %s)", headers ? "headers" : "noheaders",
@@ -533,7 +526,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	check_result(result, "isc_buffer_allocate");

 	if (query->lookup->comments && !short_form) {
-		if (query->lookup->cmdline[0] != 0 && printcmd)
+		if (query->lookup->cmdline[0] != 0)
 			printf("; %s\n", query->lookup->cmdline);
 		if (msg == query->lookup->sendmsg)
 			printf(";; Sending:\n");
@@ -1452,7 +1445,7 @@ plus_option(char *option, bool is_batchfile,
 				lookup->trace = state;
 				lookup->trace_root = state;
 				if (state) {
-					lookup->recurse = true;
+					lookup->recurse = false;
 					lookup->identify = true;
 					lookup->comments = false;
 					lookup->rrcomments = 0;
@@ -593,11 +593,9 @@
 	  <listitem>
 	    <para>
 	      Toggles the printing of the initial comment in the
-	      output, identifying the version of <command>dig</command>
-	      and the query options that have been applied.  This option
-	      always has global effect; it cannot be set globally
-	      and then overridden on a per-lookup basis.  The default
-	      is to print this comment.
+	      output identifying the version of <command>dig</command>
+	      and the query options that have been applied.  This
+	      comment is printed by default.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -606,18 +604,8 @@
 	  <term><option>+[no]comments</option></term>
 	  <listitem>
 	    <para>
-	      Toggles the display of some comment lines in the output,
-	      containing information about the packet header and
-	      OPT pseudosection, and the names of the response
-	      section.  The default is to print these comments.
-	    </para>
-	    <para>
-	      Other types of comments in the output are not affected by
-	      this option, but can be controlled using other command
-	      line switches. These include <command>+[no]cmd</command>,
-	      <command>+[no]question</command>,
-	      <command>+[no]stats</command>, and
-	      <command>+[no]rrcomments</command>.
+	      Toggle the display of comment lines in the output.
+	      The default is to print comments.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -967,8 +955,8 @@
 	  <term><option>+[no]qr</option></term>
 	  <listitem>
 	    <para>
-	      Toggles the display of the query message as it is sent.
-	      By default, the query is not printed.
+	      Print [do not print] the query as it is sent.  By
+	      default, the query is not printed.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -977,7 +965,7 @@
 	  <term><option>+[no]question</option></term>
 	  <listitem>
 	    <para>
-	      Toggles the display of the question section of a query
+	      Print [do not print] the question section of a query
 	      when an answer is returned.  The default is to print
 	      the question section as a comment.
 	    </para>
@@ -1012,10 +1000,8 @@
 	      in the query.  This bit is set by default, which means
 	      <command>dig</command> normally sends recursive
 	      queries.  Recursion is automatically disabled when
-	      using the <parameter>+nssearch</parameter> option, and
-	      when using <parameter>+trace</parameter> except for
-	      an initial recursive query to get the list of root
-	      servers.
+	      the <parameter>+nssearch</parameter> or
+	      <parameter>+trace</parameter> query options are used.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1068,9 +1054,7 @@
 	  <listitem>
 	    <para>
 	      Provide a terse answer.  The default is to print the
-	      answer in a verbose form.  This option always has global
-	      effect; it cannot be set globally and then overridden on
-	      a per-lookup basis.
+	      answer in a verbose form.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1115,9 +1099,10 @@
 	  <term><option>+[no]stats</option></term>
 	  <listitem>
 	    <para>
-	      Toggles the printing of statistics: when the query was made,
-	      the size of the reply and so on.  The default behavior is to
-	      print the query statistics as a comment after each lookup.
+	      This query option toggles the printing of statistics:
+	      when the query was made, the size of the reply and
+	      so on.  The default behavior is to print the query
+	      statistics.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -481,28 +481,16 @@
 <dd>
 	    <p>
 	      Toggles the printing of the initial comment in the
-	      output, identifying the version of <span class="command"><strong>dig</strong></span>
-	      and the query options that have been applied.  This option
-	      always has global effect; it cannot be set globally
-	      and then overridden on a per-lookup basis.  The default
-	      is to print this comment.
+	      output identifying the version of <span class="command"><strong>dig</strong></span>
+	      and the query options that have been applied.  This
+	      comment is printed by default.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]comments</code></span></dt>
 <dd>
 	    <p>
-	      Toggles the display of some comment lines in the output,
-	      containing information about the packet header and
-	      OPT pseudosection, and the names of the response
-	      section.  The default is to print these comments.
-	    </p>
-	    <p>
-	      Other types of comments in the output are not affected by
-	      this option, but can be controlled using other command
-	      line switches. These include <span class="command"><strong>+[no]cmd</strong></span>,
-	      <span class="command"><strong>+[no]question</strong></span>,
-	      <span class="command"><strong>+[no]stats</strong></span>, and
-	      <span class="command"><strong>+[no]rrcomments</strong></span>.
+	      Toggle the display of comment lines in the output.
+	      The default is to print comments.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]cookie[<span class="optional">=####</span>]</code></span></dt>
@@ -769,14 +757,14 @@
 <dt><span class="term"><code class="option">+[no]qr</code></span></dt>
 <dd>
 	    <p>
-	      Toggles the display of the query message as it is sent.
-	      By default, the query is not printed.
+	      Print [do not print] the query as it is sent.  By
+	      default, the query is not printed.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]question</code></span></dt>
 <dd>
 	    <p>
-	      Toggles the display of the question section of a query
+	      Print [do not print] the question section of a query
 	      when an answer is returned.  The default is to print
 	      the question section as a comment.
 	    </p>
@@ -802,10 +790,8 @@
 	      in the query.  This bit is set by default, which means
 	      <span class="command"><strong>dig</strong></span> normally sends recursive
 	      queries.  Recursion is automatically disabled when
-	      using the <em class="parameter"><code>+nssearch</code></em> option, and
-	      when using <em class="parameter"><code>+trace</code></em> except for
-	      an initial recursive query to get the list of root
-	      servers.
+	      the <em class="parameter"><code>+nssearch</code></em> or
+	      <em class="parameter"><code>+trace</code></em> query options are used.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+retry=T</code></span></dt>
@@ -846,9 +832,7 @@
 <dd>
 	    <p>
 	      Provide a terse answer.  The default is to print the
-	      answer in a verbose form.  This option always has global
-	      effect; it cannot be set globally and then overridden on
-	      a per-lookup basis.
+	      answer in a verbose form.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]showsearch</code></span></dt>
@@ -881,9 +865,10 @@
 <dt><span class="term"><code class="option">+[no]stats</code></span></dt>
 <dd>
 	    <p>
-	      Toggles the printing of statistics: when the query was made,
-	      the size of the reply and so on.  The default behavior is to
-	      print the query statistics as a comment after each lookup.
+	      This query option toggles the printing of statistics:
+	      when the query was made, the size of the reply and
+	      so on.  The default behavior is to print the query
+	      statistics.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]subnet=addr[/prefix-length]</code></span></dt>
@@ -1399,7 +1399,6 @@ typedef struct dig_ednsoptname {
 } dig_ednsoptname_t;

 dig_ednsoptname_t optnames[] = {
-	{ 1, "LLQ" },		/* draft-sekar-dns-llq */
 	{ 3, "NSID" },		/* RFC 5001 */
 	{ 5, "DAU" },		/* RFC 6975 */
 	{ 6, "DHU" },		/* RFC 6975 */
@@ -1412,8 +1411,6 @@ dig_ednsoptname_t optnames[] = {
 	{ 12, "PAD" },		/* shorthand */
 	{ 13, "CHAIN" },	/* RFC 7901 */
 	{ 14, "KEY-TAG" },	/* RFC 8145 */
-	{ 16, "CLIENT-TAG" },	/* draft-bellis-dnsop-edns-tags */
-	{ 17, "SERVER-TAG" },	/* draft-bellis-dnsop-edns-tags */
 	{ 26946, "DEVICEID" },	/* Brian Hartvigsen */
 };

@@ -2192,14 +2189,12 @@ setup_lookup(dig_lookup_t *lookup) {
 	lookup->sendmsg->id = (dns_messageid_t)isc_random16();
 	lookup->sendmsg->opcode = lookup->opcode;
 	lookup->msgcounter = 0;
-
 	/*
-	 * If this is a trace request, completely disallow recursion after
-	 * looking up the root name servers, since it's meaningless for traces.
+	 * If this is a trace request, completely disallow recursion, since
+	 * it's meaningless for traces.
 	 */
-	if ((lookup->trace || lookup->ns_search_only) && !lookup->trace_root) {
+	if (lookup->trace || (lookup->ns_search_only && !lookup->trace_root))
 		lookup->recurse = false;
-	}

 	if (lookup->recurse &&
 	    lookup->rdtype != dns_rdatatype_axfr &&
@@ -4379,20 +4374,9 @@ idn_ace_to_locale(const char *src, char **dst) {
 	 */
 	res = idn2_to_unicode_8zlz(utf8_src, &local_src, 0);
 	if (res != IDN2_OK) {
-		static bool warned = false;
-
-		res = idn2_to_ascii_8z(utf8_src, &local_src, 0);
-		if (res != IDN2_OK) {
-			fatal("Cannot represent '%s' "
-			      "in the current locale nor ascii (%s), "
-			      "use +noidnout or a different locale",
-			      src, idn2_strerror(res));
-		} else if (!warned) {
-			fprintf(stderr, ";; Warning: cannot represent '%s' "
-			      "in the current locale",
-			      local_src);
-			warned = true;
-		}
+		fatal("Cannot represent '%s' in the current locale (%s), "
+		      "use +noidnout or a different locale",
+		      src, idn2_strerror(res));
 	}

 	/*
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -269,5 +269,5 @@ runs\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -301,5 +301,5 @@ runs or when the standard output is not a tty\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -879,29 +879,12 @@ get_next_command(void) {
 	isc_mem_free(mctx, buf);
 }

-ISC_PLATFORM_NORETURN_PRE static void
-usage(void) ISC_PLATFORM_NORETURN_POST;
-
-static void
-usage(void) {
-    fprintf(stderr, "Usage:\n");
-    fprintf(stderr,
-"   nslookup [-opt ...]             # interactive mode using default server\n");
-    fprintf(stderr,
-"   nslookup [-opt ...] - server    # interactive mode using 'server'\n");
-    fprintf(stderr,
-"   nslookup [-opt ...] host        # just look up 'host' using default server\n");
-    fprintf(stderr,
-"   nslookup [-opt ...] host server # just look up 'host' using 'server'\n");
-    exit(1);
-}
-
 static void
 parse_args(int argc, char **argv) {
 	bool have_lookup = false;

 	usesearch = true;
-	for (argc--, argv++; argc > 0 && argv[0] != NULL; argc--, argv++) {
+	for (argc--, argv++; argc > 0; argc--, argv++) {
 		debug("main parsing %s", argv[0]);
 		if (argv[0][0] == '-') {
 			if (strncasecmp(argv[0], "-ver", 4) == 0) {
@@ -917,9 +900,6 @@ parse_args(int argc, char **argv) {
 				in_use = true;
 				addlookup(argv[0]);
 			} else {
-				if (argv[1] != NULL) {
-					usage();
-				}
 				set_nameserver(argv[0]);
 				check_ra = false;
 			}
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{F938F9B8-D395-4A40-BEC7-0122D289C692}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>dig</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{140DE800-E552-43CC-B0C7-A33A92E368CA}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>dighost</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{BA1048A8-6961-4A20-BE12-08BE20611C9D}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>host</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{C15A6E1A-94CE-4686-99F9-6BC5FD623EB5}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>nslookup</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -20,7 +20,7 @@ CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
 CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =

-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -102,7 +102,7 @@ Specify a digest algorithm to use when converting CDNSKEY records to DS records\
 .sp
 The
 \fIalgorithm\fR
-must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
 .RE
 .PP
 \-c \fIclass\fR
@@ -293,5 +293,5 @@ RFC 7344\&.
 .RE
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -86,7 +86,7 @@ static dns_rdataclass_t rdclass = dns_rdataclass_in;
 * List of digest types used by ds_from_cdnskey(), filled in by add_dtype()
 * from -a arguments. The size of the array is an arbitrary limit.
 */
-static dns_dsdigest_t dtype[8];
+static uint8_t dtype[8];

 static const char *startstr  = NULL;	/* from which we derive notbefore */
 static isc_stdtime_t notbefore = 0;	/* restrict sig inception times */
@@ -129,7 +129,7 @@ static int nkey; /* number of child zone DNSKEY records */
 typedef struct keyinfo {
 	dns_rdata_t rdata;
 	dst_key_t *dst;
-	dns_secalg_t algo;
+	uint8_t algo;
 	dns_keytag_t tag;
 } keyinfo_t;

@@ -614,12 +614,12 @@ free_keytable(keyinfo_t **keytable_p) {
 * otherwise the key algorithm. This is used by the signature coverage
 * check functions below.
 */
-static dns_secalg_t *
+static uint8_t *
 matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	      dns_rdataset_t *sigset)
 {
 	isc_result_t result;
-	dns_secalg_t *algo;
+	uint8_t *algo;
 	int i;

 	algo = isc_mem_get(mctx, nkey);
@@ -702,7 +702,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 * fetched from the child zone, any working signature is enough.
 */
 static bool
-signed_loose(dns_secalg_t *algo) {
+signed_loose(uint8_t *algo) {
 	bool ok = false;
 	int i;
 	for (i = 0; i < nkey; i++) {
@@ -721,7 +721,7 @@ signed_loose(dns_secalg_t *algo) {
 * RRset.
 */
 static bool
-signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
+signed_strict(dns_rdataset_t *dsset, uint8_t *algo) {
 	isc_result_t result;
 	bool all_ok = true;

@@ -844,14 +844,14 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
 */
 static int
 cmp_dtype(const void *ap, const void *bp) {
-	int a = *(const dns_dsdigest_t *)ap;
-	int b = *(const dns_dsdigest_t *)bp;
+	int a = *(const uint8_t *)ap;
+	int b = *(const uint8_t *)bp;
 	return (a - b);
 }

 static void
 add_dtype(const char *dn) {
-	dns_dsdigest_t dt;
+	uint8_t dt;
 	unsigned i, n;

 	dt = strtodsdigest(dn);
@@ -936,7 +936,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	dns_rdata_t *arrdata;
 	dns_rdata_ds_t *ds;
 	dns_keytag_t key_tag;
-	dns_secalg_t algorithm;
+	uint8_t algorithm;
 	bool match;
 	int i, j, n, d;

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -129,9 +129,9 @@
 	    record. This option has no effect when using CDS records.
          </p>
          <p>
-	    The <em class="replaceable"><code>algorithm</code></em> must be one of
-	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
-	    and the hyphen may be omitted.  If no algorithm is specified,
+	    The <em class="replaceable"><code>algorithm</code></em> must be one of SHA-1
+	    (SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
+	    values are case insensitive. If no algorithm is specified,
 	    the default is SHA-256.
          </p>
        </dd>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,103 +39,61 @@
 dnssec-dsfromkey \- DNSSEC DS RR generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {keyfile}
+\fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] {keyfile}
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-A\fR] {\fB\-f\ \fR\fB\fIfile\fR\fR} [dnsname]
+\fBdnssec\-dsfromkey\fR {\-s} [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-A\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {dnsname}
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {\-s} {dnsname}
-.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-h\fR | \fB\-V\fR]
+\fBdnssec\-dsfromkey\fR [\fB\-h\fR] [\fB\-V\fR]
 .SH "DESCRIPTION"
 .PP
-The
 \fBdnssec\-dsfromkey\fR
-command outputs DS (Delegation Signer) resource records (RRs) and other similarly\-constructed RRs: with the
-\fB\-l\fR
-option it outputs DLV (DNSSEC Lookaside Validation) RRs; or with the
-\fB\-C\fR
-it outputs CDS (Child DS) RRs\&.
-.PP
-The input keys can be specified in a number of ways:
-.PP
-By default,
-\fBdnssec\-dsfromkey\fR
-reads a key file named like
-Knnnn\&.+aaa+iiiii\&.key, as generated by
-\fBdnssec\-keygen\fR\&.
-.PP
-With the
-\fB\-f \fR\fB\fIfile\fR\fR
-option,
-\fBdnssec\-dsfromkey\fR
-reads keys from a zone file or partial zone file (which can contain just the DNSKEY records)\&.
-.PP
-With the
-\fB\-s\fR
-option,
-\fBdnssec\-dsfromkey\fR
-reads a
-keyset\-
-file, as generated by
-\fBdnssec\-keygen\fR\fB\-C\fR\&.
+outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s)\&.
 .SH "OPTIONS"
 .PP
 \-1
 .RS 4
-An abbreviation for
-\fB\-a SHA1\fR
+Use SHA\-1 as the digest algorithm (the default is to use both SHA\-1 and SHA\-256)\&.
 .RE
 .PP
 \-2
 .RS 4
-An abbreviation for
-\fB\-a SHA\-256\fR
+Use SHA\-256 as the digest algorithm\&.
 .RE
 .PP
 \-a \fIalgorithm\fR
 .RS 4
-Specify a digest algorithm to use when converting DNSKEY records to DS records\&. This option can be repeated, so that multiple DS records are created for each DNSKEY record\&.
-.sp
-The
-\fIalgorithm\fR
-must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
-.RE
-.PP
-\-A
-.RS 4
-Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in
-\fB\-f\fR
-zone file mode\&.
-.RE
-.PP
-\-c \fIclass\fR
-.RS 4
-Specifies the DNS class (default is IN)\&. Useful only in
-\fB\-s\fR
-keyset or
-\fB\-f\fR
-zone file mode\&.
+Select the digest algorithm\&. The value of
+\fBalgorithm\fR
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256) or SHA\-384 (SHA384)\&. These values are case insensitive\&.
 .RE
 .PP
 \-C
 .RS 4
-Generate CDS records rather than DS records\&. This is mutually exclusive with the
-\fB\-l\fR
-option for generating DLV records\&.
+Generate CDS records rather than DS records\&. This is mutually exclusive with generating lookaside records\&.
+.RE
+.PP
+\-T \fITTL\fR
+.RS 4
+Specifies the TTL of the DS records\&.
+.RE
+.PP
+\-K \fIdirectory\fR
+.RS 4
+Look for key files (or, in keyset mode,
+keyset\-
+files) in
+\fBdirectory\fR\&.
 .RE
 .PP
 \-f \fIfile\fR
 .RS 4
-Zone file mode:
-\fBdnssec\-dsfromkey\fR\*(Aqs final
-\fIdnsname\fR
-argument is the DNS domain name of a zone whose master file can be read from
+Zone file mode: in place of the keyfile name, the argument is the DNS domain name of a zone master file, which can be read from
 \fBfile\fR\&. If the zone name is the same as
 \fBfile\fR, then it may be omitted\&.
 .sp
 If
-\fIfile\fR
-is
+\fBfile\fR
+is set to
 "\-", then the zone data is read from the standard input\&. This makes it possible to use the output of the
 \fBdig\fR
 command as input, as in:
@@ -143,41 +101,26 @@ command as input, as in:
 \fBdig dnskey example\&.com | dnssec\-dsfromkey \-f \- example\&.com\fR
 .RE
 .PP
-\-h
+\-A
 .RS 4
-Prints usage information\&.
-.RE
-.PP
-\-K \fIdirectory\fR
-.RS 4
-Look for key files or
-keyset\-
-files in
-\fBdirectory\fR\&.
+Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in zone file mode\&.
 .RE
 .PP
 \-l \fIdomain\fR
 .RS 4
 Generate a DLV set instead of a DS set\&. The specified
-\fIdomain\fR
-is appended to the name for each record in the set\&. This is mutually exclusive with the
-\fB\-C\fR
-option for generating CDS records\&.
+\fBdomain\fR
+is appended to the name for each record in the set\&. The DNSSEC Lookaside Validation (DLV) RR is described in RFC 4431\&. This is mutually exclusive with generating CDS records\&.
 .RE
 .PP
 \-s
 .RS 4
-Keyset mode:
-\fBdnssec\-dsfromkey\fR\*(Aqs final
-\fIdnsname\fR
-argument is the DNS domain name used to locate a
-keyset\-
-file\&.
+Keyset mode: in place of the keyfile name, the argument is the DNS domain name of a keyset file\&.
 .RE
 .PP
-\-T \fITTL\fR
+\-c \fIclass\fR
 .RS 4
-Specifies the TTL of the DS records\&. By default the TTL is omitted\&.
+Specifies the DNS class (default is IN)\&. Useful only in keyset or zone file mode\&.
 .RE
 .PP
 \-v \fIlevel\fR
@@ -185,6 +128,11 @@ Specifies the TTL of the DS records\&. By default the TTL is omitted\&.
 Sets the debugging level\&.
 .RE
 .PP
+\-h
+.RS 4
+Prints usage information\&.
+.RE
+.PP
 \-V
 .RS 4
 Prints version information\&.
@@ -193,16 +141,16 @@ Prints version information\&.
 .PP
 To build the SHA\-256 DS RR from the
 \fBKexample\&.com\&.+003+26160\fR
-keyfile name, you can issue the following command:
+keyfile name, the following command would be issued:
 .PP
 \fBdnssec\-dsfromkey \-2 Kexample\&.com\&.+003+26160\fR
 .PP
 The command would print something like:
 .PP
-\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94\fR
+\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94\fR
 .SH "FILES"
 .PP
-The keyfile can be designated by the key identification
+The keyfile can be designed by the key identification
 Knnnn\&.+aaa+iiiii
 or the full file name
 Knnnn\&.+aaa+iiiii\&.key
@@ -222,20 +170,13 @@ A keyfile error can give a "file not found" even if the file exists\&.
 \fBdnssec-keygen\fR(8),
 \fBdnssec-signzone\fR(8),
 BIND 9 Administrator Reference Manual,
-RFC 3658
-(DS RRs),
-RFC 4431
-(DLV RRs),
-RFC 4509
-(SHA\-256 for DS RRs),
-RFC 6605
-(SHA\-384 for DS RRs),
-RFC 7344
-(CDS and CDNSKEY RRs)\&.
+RFC 3658,
+RFC 4431\&.
+RFC 4509\&.
 .SH "AUTHOR"
 .PP
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -235,7 +235,7 @@ logkey(dns_rdata_t *rdata)
 }

 static void
-emit(dns_dsdigest_t dtype, bool showall, char *lookaside,
+emit(unsigned int dtype, bool showall, char *lookaside,
     bool cds, dns_rdata_t *rdata)
 {
 	isc_result_t result;
@@ -350,7 +350,7 @@ main(int argc, char **argv) {
 	char		*lookaside = NULL;
 	char		*endp;
 	int		ch;
-	dns_dsdigest_t	dtype = DNS_DSDIGEST_SHA1;
+	unsigned int	dtype = DNS_DSDIGEST_SHA1;
 	bool	cds = false;
 	bool	both = true;
 	bool	usekeyset = false;
@@ -362,14 +362,12 @@ main(int argc, char **argv) {

 	dns_rdata_init(&rdata);

-	if (argc == 1) {
+	if (argc == 1)
 		usage();
-	}

 	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");
-	}

 #if USE_PKCS11
 	pk11_result_register();
@@ -397,10 +395,9 @@ main(int argc, char **argv) {
 			both = false;
 			break;
 		case 'C':
-			if (lookaside != NULL) {
+			if (lookaside != NULL)
 				fatal("lookaside and CDS are mutually"
 				      " exclusive");
-			}
 			cds = true;
 			break;
 		case 'c':
@@ -412,18 +409,16 @@ main(int argc, char **argv) {
 			/* fall through */
 		case 'K':
 			dir = isc_commandline_argument;
-			if (strlen(dir) == 0U) {
+			if (strlen(dir) == 0U)
 				fatal("directory must be non-empty string");
-			}
 			break;
 		case 'f':
 			filename = isc_commandline_argument;
 			break;
 		case 'l':
-			if (cds) {
+			if (cds)
 				fatal("lookaside and CDS are mutually"
 				      " exclusive");
-			}
 			lookaside = isc_commandline_argument;
 			if (strlen(lookaside) == 0U)
 				fatal("lookaside must be a non-empty string");
@@ -437,18 +432,16 @@ main(int argc, char **argv) {
 			break;
 		case 'v':
 			verbose = strtol(isc_commandline_argument, &endp, 0);
-			if (*endp != '\0') {
+			if (*endp != '\0')
 				fatal("-v must be followed by a number");
-			}
 			break;
 		case 'F':
 			/* Reserved for FIPS mode */
 			/* FALLTHROUGH */
 		case '?':
-			if (isc_commandline_option != '?') {
+			if (isc_commandline_option != '?')
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
-			}
 			/* FALLTHROUGH */
 		case 'h':
 			/* Does not return. */
@@ -467,56 +460,46 @@ main(int argc, char **argv) {

 	rdclass = strtoclass(classname);

-	if (usekeyset && filename != NULL) {
+	if (usekeyset && filename != NULL)
 		fatal("cannot use both -s and -f");
-	}

 	/* When not using -f, -A is implicit */
-	if (filename == NULL) {
+	if (filename == NULL)
 		showall = true;
-	}

-	if (argc < isc_commandline_index + 1 && filename == NULL) {
+	if (argc < isc_commandline_index + 1 && filename == NULL)
 		fatal("the key file name was not specified");
-	}
-	if (argc > isc_commandline_index + 1) {
+	if (argc > isc_commandline_index + 1)
 		fatal("extraneous arguments");
-	}

 	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
-	}

 	setup_logging(mctx, &log);

 	dns_rdataset_init(&rdataset);

 	if (usekeyset || filename != NULL) {
-		if (argc < isc_commandline_index + 1) {
+		if (argc < isc_commandline_index + 1 && filename != NULL) {
 			/* using zone name as the zone file name */
 			namestr = filename;
-		} else {
+		} else
 			namestr = argv[isc_commandline_index];
-		}

 		result = initname(namestr);
-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS)
 			fatal("could not initialize name %s", namestr);
-		}

-		if (usekeyset) {
+		if (usekeyset)
 			result = loadkeyset(dir, &rdataset);
-		} else {
-			INSIST(filename != NULL);
+		else
 			result = loadset(filename, &rdataset);
-		}

-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS)
 			fatal("could not load DNSKEY set: %s\n",
 			      isc_result_totext(result));
-		}

 		for (result = dns_rdataset_first(&rdataset);
 		     result == ISC_R_SUCCESS;
@@ -524,18 +507,16 @@ main(int argc, char **argv) {
 			dns_rdata_init(&rdata);
 			dns_rdataset_current(&rdataset, &rdata);

-			if (verbose > 2) {
+			if (verbose > 2)
 				logkey(&rdata);
-			}

 			if (both) {
 				emit(DNS_DSDIGEST_SHA1, showall, lookaside,
 				     cds, &rdata);
 				emit(DNS_DSDIGEST_SHA256, showall, lookaside,
 				     cds, &rdata);
-			} else {
+			} else
 				emit(dtype, showall, lookaside, cds, &rdata);
-			}
 		}
 	} else {
 		unsigned char key_buf[DST_KEY_MAXSIZE];
@@ -548,9 +529,8 @@ main(int argc, char **argv) {
 			     &rdata);
 			emit(DNS_DSDIGEST_SHA256, showall, lookaside, cds,
 			     &rdata);
-		} else {
+		} else
 			emit(dtype, showall, lookaside, cds, &rdata);
-		}
 	}

 	if (dns_rdataset_isassociated(&rdataset))
@@ -558,16 +538,14 @@ main(int argc, char **argv) {
 	cleanup_logging(&log);
 	dst_lib_destroy();
 	dns_name_destroy();
-	if (verbose > 10) {
+	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
-	}
 	isc_mem_destroy(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
 		return (1);
-	} else {
+	} else
 		return (0);
-	}
 }
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -33,167 +33,105 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
-       [
-	 <code class="option">-1</code> 
-	 |   <code class="option">-2</code> 
-	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
-      ]
-       [
-	 <code class="option">-C</code> 
-	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
-      ]
-       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-1</code>]
+       [<code class="option">-2</code>]
+       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
+       [<code class="option">-C</code>]
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
       {keyfile}
    </p></div>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
-       [
-	 <code class="option">-1</code> 
-	 |   <code class="option">-2</code> 
-	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
-      ]
-       [
-	 <code class="option">-C</code> 
-	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
-      ]
-       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
-       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
-       [<code class="option">-A</code>]
-       {<code class="option">-f <em class="replaceable"><code>file</code></em></code>}
-       [dnsname]
-    </p></div>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-dsfromkey</code> 
-       [
-	 <code class="option">-1</code> 
-	 |   <code class="option">-2</code> 
-	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
-      ]
-       [
-	 <code class="option">-C</code> 
-	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
-      ]
-       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
-       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
-       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
       {-s}
+       [<code class="option">-1</code>]
+       [<code class="option">-2</code>]
+       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-s</code>]
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
+       [<code class="option">-A</code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
       {dnsname}
-    </p></div>
+   </p></div>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
-       [
-	 <code class="option">-h</code> 
-	 |   <code class="option">-V</code> 
-      ]
-    </p></div>
+       [<code class="option">-h</code>]
+       [<code class="option">-V</code>]
+   </p></div>
  </div>

  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>

-    <p>
-      The <span class="command"><strong>dnssec-dsfromkey</strong></span> command outputs DS (Delegation
-      Signer) resource records (RRs) and other similarly-constructed RRs:
-      with the <code class="option">-l</code> option it outputs DLV (DNSSEC Lookaside
-      Validation) RRs; or with the <code class="option">-C</code> it outputs CDS (Child
-      DS) RRs.
+    <p><span class="command"><strong>dnssec-dsfromkey</strong></span>
+      outputs the Delegation Signer (DS) resource record (RR), as defined in
+      RFC 3658 and RFC 4509, for the given key(s).
    </p>
-
-    <p>
-      The input keys can be specified in a number of ways:
-    </p>
-
-    <p>
-      By default, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads a key file
-      named like <code class="filename">Knnnn.+aaa+iiiii.key</code>, as generated
-      by <span class="command"><strong>dnssec-keygen</strong></span>.
-    </p>
-
-    <p>
-      With the <code class="option">-f <em class="replaceable"><code>file</code></em></code>
-      option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads keys from a zone file
-      or partial zone file (which can contain just the DNSKEY records).
-    </p>
-
-    <p>
-      With the <code class="option">-s</code>
-      option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads
-      a <code class="filename">keyset-</code> file, as generated
-      by <span class="command"><strong>dnssec-keygen</strong></span> <code class="option">-C</code>.
-    </p>
-
  </div>

  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>

+
    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-1</span></dt>
 <dd>
 	  <p>
-	    An abbreviation for <code class="option">-a SHA1</code>
+	    Use SHA-1 as the digest algorithm (the default is to use
+	    both SHA-1 and SHA-256).
 	  </p>
 	</dd>
 <dt><span class="term">-2</span></dt>
 <dd>
 	  <p>
-	    An abbreviation for <code class="option">-a SHA-256</code>
+	    Use SHA-256 as the digest algorithm.
 	  </p>
 	</dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
 	  <p>
-	    Specify a digest algorithm to use when converting DNSKEY
-	    records to DS records. This option can be repeated, so
-	    that multiple DS records are created for each DNSKEY
-	    record.
-          </p>
-          <p>
-	    The <em class="replaceable"><code>algorithm</code></em> must be one of
-	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
-	    and the hyphen may be omitted.  If no algorithm is specified,
-	    the default is SHA-256.
+	    Select the digest algorithm. The value of
+	    <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
+	    SHA-256 (SHA256) or SHA-384 (SHA384).
+	    These values are case insensitive.
 	  </p>
 	</dd>
-<dt><span class="term">-A</span></dt>
-<dd>
-          <p>
-            Include ZSKs when generating DS records. Without this option, only
-            keys which have the KSK flag set will be converted to DS records
-            and printed. Useful only in <code class="option">-f</code> zone file mode.
-          </p>
-        </dd>
-<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd>
-	  <p>
-	    Specifies the DNS class (default is IN). Useful only
-	    in <code class="option">-s</code> keyset or <code class="option">-f</code>
-	    zone file mode.
-	  </p>
-	  </dd>
 <dt><span class="term">-C</span></dt>
 <dd>
 	  <p>
-	    Generate CDS records rather than DS records. This is mutually
-	    exclusive with the <code class="option">-l</code> option for generating DLV
-	    records.
+	    Generate CDS records rather than DS records.  This is mutually
+	    exclusive with generating lookaside records.
+	  </p>
+	</dd>
+<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
+<dd>
+	  <p>
+	    Specifies the TTL of the DS records.
+	  </p>
+	  </dd>
+<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
+<dd>
+	  <p>
+	    Look for key files (or, in keyset mode,
+	    <code class="filename">keyset-</code> files) in
+	    <code class="option">directory</code>.
 	  </p>
 	</dd>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
 <dd>
 	  <p>
-	    Zone file mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
-	    final <em class="replaceable"><code>dnsname</code></em> argument is
-	    the DNS domain name of a zone whose master file can be read
+	    Zone file mode: in place of the keyfile name, the argument is
+	    the DNS domain name of a zone master file, which can be read
 	    from <code class="option">file</code>.  If the zone name is the same as
 	    <code class="option">file</code>, then it may be omitted.
 	  </p>
 	  <p>
-	    If <em class="replaceable"><code>file</code></em> is <code class="literal">"-"</code>, then
+	    If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
 	    the zone data is read from the standard input.  This makes it
 	    possible to use the output of the <span class="command"><strong>dig</strong></span>
 	    command as input, as in:
@@ -202,41 +140,37 @@
 	    <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
 	  </p>
 	</dd>
-<dt><span class="term">-h</span></dt>
+<dt><span class="term">-A</span></dt>
 <dd>
-	  <p>
-	    Prints usage information.
-	  </p>
-	</dd>
-<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd>
-	  <p>
-	    Look for key files or <code class="filename">keyset-</code> files in
-	    <code class="option">directory</code>.
-	  </p>
-	</dd>
+          <p>
+            Include ZSKs when generating DS records.  Without this option,
+            only keys which have the KSK flag set will be converted to DS
+            records and printed.  Useful only in zone file mode.
+          </p>
+        </dd>
 <dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
 <dd>
 	  <p>
-	    Generate a DLV set instead of a DS set. The specified
-	    <em class="replaceable"><code>domain</code></em> is appended to the name for each
+	    Generate a DLV set instead of a DS set.  The specified
+	    <code class="option">domain</code> is appended to the name for each
 	    record in the set.
-	    This is mutually exclusive with the <code class="option">-C</code> option
-	    for generating CDS records.
+	    The DNSSEC Lookaside Validation (DLV) RR is described
+	    in RFC 4431.  This is mutually exclusive with generating
+	    CDS records.
 	  </p>
 	</dd>
 <dt><span class="term">-s</span></dt>
 <dd>
 	  <p>
-	    Keyset mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
-	    final <em class="replaceable"><code>dnsname</code></em> argument is the DNS
-	    domain name used to locate a <code class="filename">keyset-</code> file.
+	    Keyset mode: in place of the keyfile name, the argument is
+	    the DNS domain name of a keyset file.
 	  </p>
 	</dd>
-<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
+<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd>
 	  <p>
-	    Specifies the TTL of the DS records. By default the TTL is omitted.
+	    Specifies the DNS class (default is IN).  Useful only
+	    in keyset or zone file mode.
 	  </p>
 	  </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
@@ -245,6 +179,12 @@
 	    Sets the debugging level.
 	  </p>
 	</dd>
+<dt><span class="term">-h</span></dt>
+<dd>
+	  <p>
+	    Prints usage information.
+	  </p>
+	</dd>
 <dt><span class="term">-V</span></dt>
 <dd>
 	  <p>
@@ -260,23 +200,22 @@
    <p>
      To build the SHA-256 DS RR from the
      <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
-      keyfile name, you can issue the following command:
+      keyfile name, the following command would be issued:
    </p>
    <p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
    </p>
    <p>
      The command would print something like:
    </p>
-    <p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</code></strong>
+    <p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
    </p>
-
  </div>

  <div class="refsection">
 <a name="id-1.10"></a><h2>FILES</h2>

    <p>
-      The keyfile can be designated by the key identification
+      The keyfile can be designed by the key identification
      <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
      <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
      <span class="refentrytitle">dnssec-keygen</span>(8).
@@ -306,11 +245,9 @@
 	<span class="refentrytitle">dnssec-signzone</span>(8)
      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 3658</em> (DS RRs),
-      <em class="citetitle">RFC 4431</em> (DLV RRs),
-      <em class="citetitle">RFC 4509</em> (SHA-256 for DS RRs),
-      <em class="citetitle">RFC 6605</em> (SHA-384 for DS RRs),
-      <em class="citetitle">RFC 7344</em> (CDS and CDNSKEY RRs).
+      <em class="citetitle">RFC 3658</em>,
+      <em class="citetitle">RFC 4431</em>.
+      <em class="citetitle">RFC 4509</em>.
    </p>
  </div>

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -134,5 +134,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -55,7 +55,7 @@ of the key is specified on the command line\&. This must match the name of the z
 .RS 4
 Selects the cryptographic algorithm\&. The value of
 \fBalgorithm\fR
-must be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
+must be one of RSAMD5, RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
 .sp
 If no algorithm is specified, then RSASHA1 will be used by default, unless the
 \fB\-3\fR
@@ -307,5 +307,5 @@ The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13)\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -89,7 +89,7 @@
 <dd>
 	  <p>
 	    Selects the cryptographic algorithm.  The value of
-	    <code class="option">algorithm</code> must be one of RSASHA1,
+	    <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </p>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -58,18 +58,11 @@ may be preferable to direct use of
 \fBdnssec\-keygen\fR\&.
 .SH "OPTIONS"
 .PP
-\-3
-.RS 4
-Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used with an algorithm that has both NSEC and NSEC3 versions, then the NSEC3 version will be used; for example,
-\fBdnssec\-keygen \-3a RSASHA1\fR
-specifies the NSEC3RSASHA1 algorithm\&.
-.RE
-.PP
 \-a \fIalgorithm\fR
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
+must be one of RSAMD5, RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
 \fB\-T KEY\fR
 option as well\&.
 .sp
@@ -90,15 +83,29 @@ to generate TSIG keys\&.
 .PP
 \-b \fIkeysize\fR
 .RS 4
-Specifies the number of bits in the key\&. The choice of key size depends on the algorithm used\&. RSA keys must be between 1024 and 4096 bits\&. Diffie Hellman keys must be between 128 and 4096 bits\&. Elliptic curve algorithms don\*(Aqt need this parameter\&.
+Specifies the number of bits in the key\&. The choice of key size depends on the algorithm used\&. RSA keys must be between 1024 and 2048 bits\&. Diffie Hellman keys must be between 128 and 4096 bits\&. DSA keys must be between 512 and 1024 bits and an exact multiple of 64\&. HMAC keys must be between 1 and 512 bits\&. Elliptic curve algorithms don\*(Aqt need this parameter\&.
 .sp
 If the key size is not specified, some algorithms have pre\-defined defaults\&. For example, RSA keys for use as DNSSEC zone signing keys have a default size of 1024 bits; RSA keys for use as key signing keys (KSKs, generated with
 \fB\-f KSK\fR) default to 2048 bits\&.
 .RE
 .PP
+\-n \fInametype\fR
+.RS 4
+Specifies the owner type of the key\&. The value of
+\fBnametype\fR
+must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. Defaults to ZONE for DNSKEY generation\&.
+.RE
+.PP
+\-3
+.RS 4
+Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used with an algorithm that has both NSEC and NSEC3 versions, then the NSEC3 version will be used; for example,
+\fBdnssec\-keygen \-3a RSASHA1\fR
+specifies the NSEC3RSASHA1 algorithm\&.
+.RE
+.PP
 \-C
 .RS 4
-Compatibility mode: generates an old\-style key, without any timing metadata\&. By default,
+Compatibility mode: generates an old\-style key, without any metadata\&. By default,
 \fBdnssec\-keygen\fR
 will include the key\*(Aqs creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc)\&. Keys that include this data may be incompatible with older versions of BIND; the
 \fB\-C\fR
@@ -143,6 +150,11 @@ Prints a short summary of the options and arguments to
 Sets the directory in which the key files are to be written\&.
 .RE
 .PP
+\-k
+.RS 4
+Deprecated in favor of \-T KEY\&.
+.RE
+.PP
 \-L \fIttl\fR
 .RS 4
 Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL\&. Setting the default TTL to
@@ -152,17 +164,9 @@ none
 is the same as leaving it unset\&.
 .RE
 .PP
-\-n \fInametype\fR
-.RS 4
-Specifies the owner type of the key\&. The value of
-\fBnametype\fR
-must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. Defaults to ZONE for DNSKEY generation\&.
-.RE
-.PP
 \-p \fIprotocol\fR
 .RS 4
-Sets the protocol value for the generated key, for use with
-\fB\-T KEY\fR\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&.
+Sets the protocol value for the generated key\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&.
 .RE
 .PP
 \-q
@@ -189,25 +193,27 @@ Specifies the strength value of the key\&. The strength is a number between 0 an
 Specifies the resource record type to use for the key\&.
 \fBrrtype\fR
 must be either DNSKEY or KEY\&. The default is DNSKEY when using a DNSSEC algorithm, but it can be overridden to KEY for use with SIG(0)\&.
+Specifying any TSIG algorithm (HMAC\-* or DH) with
+\fB\-a\fR
+forces this option to KEY\&.
 .RE
 .PP
 \-t \fItype\fR
 .RS 4
-Indicates the use of the key, for use with
-\fB\-T KEY\fR\&.
+Indicates the use of the key\&.
 \fBtype\fR
 must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF\&. The default is AUTHCONF\&. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data\&.
 .RE
 .PP
-\-V
-.RS 4
-Prints version information\&.
-.RE
-.PP
 \-v \fIlevel\fR
 .RS 4
 Sets the debugging level\&.
 .RE
+.PP
+\-V
+.RS 4
+Prints version information\&.
+.RE
 .SH "TIMING OPTIONS"
 .PP
 Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argument begins with a \*(Aq+\*(Aq or \*(Aq\-\*(Aq, it is interpreted as an offset from the present time\&. For convenience, if such an offset is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively\&. Without a suffix, the offset is computed in seconds\&. To explicitly prevent a date from being set, use \*(Aqnone\*(Aq or \*(Aqnever\*(Aq\&.
@@ -308,24 +314,23 @@ contains the private key\&.
 .PP
 The
 \&.key
-file contains a DNSKEY or KEY record\&. When a zone is being signed by
-\fBnamed\fR
-or
-\fBdnssec\-signzone\fR\fB\-S\fR, DNSKEY records are included automatically\&. In other cases, the
-\&.key
-file can be inserted into a zone file manually or with a
-\fB$INCLUDE\fR
-statement\&.
+file contains a DNS KEY record that can be inserted into a zone file (directly or with a $INCLUDE statement)\&.
 .PP
 The
 \&.private
 file contains algorithm\-specific fields\&. For obvious security reasons, this file does not have general read permission\&.
+.PP
+Both
+\&.key
+and
+\&.private
+files are generated for symmetric cryptography algorithms such as HMAC\-MD5, even though the public and private key are equivalent\&.
 .SH "EXAMPLE"
 .PP
-To generate an ECDSAP256SHA256 zone\-signing key for the zone
-\fBexample\&.com\fR, issue the command:
+To generate an ECDSAP256SHA256 key for the domain
+\fBexample\&.com\fR, the following command would be issued:
 .PP
-\fBdnssec\-keygen \-a ECDSAP256SHA256 example\&.com\fR
+\fBdnssec\-keygen \-a ECDSAP256SHA256 \-n ZONE example\&.com\fR
 .PP
 The command would print a string of the form:
 .PP
@@ -337,10 +342,6 @@ creates the files
 Kexample\&.com\&.+013+26160\&.key
 and
 Kexample\&.com\&.+013+26160\&.private\&.
-.PP
-To generate a matching key\-signing key, issue the command:
-.PP
-\fBdnssec\-keygen \-a ECDSAP256SHA256 \-f KSK example\&.com\fR
 .SH "SEE ALSO"
 .PP
 \fBdnssec-signzone\fR(8),
@@ -353,5 +354,5 @@ RFC 4034\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -241,7 +241,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:L:m:n:P:p:qR:r:S:s:T:t:" \
+#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:kL:m:n:P:p:qR:r:S:s:T:t:" \
 		      "v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -322,6 +322,11 @@ main(int argc, char **argv) {
 				fatal("cannot open directory %s: %s",
 				      directory, isc_result_totext(ret));
 			break;
+		case 'k':
+			fatal("The -k option has been deprecated.\n"
+			      "To generate a key-signing key, use -f KSK.\n"
+			      "To generate a key with TYPE=KEY, use -T KEY.\n");
+			break;
 		case 'L':
 			ttl = strtottl(isc_commandline_argument);
 			setttl = true;
@@ -58,10 +58,11 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-keygen</command>
-      <arg choice="opt" rep="norepeat"><option>-3</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-3</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-C</option></arg>
      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
@@ -76,7 +77,6 @@
      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-k</option></arg>
      <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
@@ -87,6 +87,7 @@
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-V</option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-z</option></arg>
      <arg choice="req" rep="norepeat">name</arg>
    </cmdsynopsis>
  </refsynopsisdiv>
@@ -117,20 +118,6 @@


    <variablelist>
-
-      <varlistentry>
-	<term>-3</term>
-	<listitem>
-	  <para>
-	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used with an algorithm that has both
-	    NSEC and NSEC3 versions, then the NSEC3 version will be
-	    used; for example, <command>dnssec-keygen -3a RSASHA1</command>
-	    specifies the NSEC3RSASHA1 algorithm.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
 	<listitem>
@@ -170,9 +157,11 @@
 	  <para>
 	    Specifies the number of bits in the key.  The choice of key
 	    size depends on the algorithm used.  RSA keys must be
-	    between 1024 and 4096 bits.  Diffie Hellman keys must be between
-	    128 and 4096 bits.  Elliptic curve algorithms don't need this
-	    parameter.
+	    between 1024 and 2048 bits.  Diffie Hellman keys must be between
+	    128 and 4096 bits.  DSA keys must be between 512 and 1024
+	    bits and an exact multiple of 64.  HMAC keys must be
+	    between 1 and 512 bits. Elliptic curve algorithms don't need
+	    this parameter.
 	  </para>
 	  <para>
 	    If the key size is not specified, some algorithms have
@@ -184,16 +173,43 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-n <replaceable class="parameter">nametype</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the owner type of the key.  The value of
+	    <option>nametype</option> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+	    with a host (KEY)), USER (for a key associated with a
+	    user(KEY)) or OTHER (DNSKEY).  These values are case
+	    insensitive.  Defaults to ZONE for DNSKEY generation.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-3</term>
+	<listitem>
+	  <para>
+	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
+	    If this option is used with an algorithm that has both
+	    NSEC and NSEC3 versions, then the NSEC3 version will be
+	    used; for example, <command>dnssec-keygen -3a RSASHA1</command>
+	    specifies the NSEC3RSASHA1 algorithm.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-C</term>
 	<listitem>
 	  <para>
-	    Compatibility mode: generates an old-style key, without any
-	    timing metadata. By default, <command>dnssec-keygen</command>
-	    will include the key's creation date in the metadata stored with
-	    the private key, and other dates may be set there as well
-	    (publication date, activation date, etc). Keys that include this
-	    data may be incompatible with older versions of BIND; the
+	    Compatibility mode:  generates an old-style key, without
+	    any metadata.  By default, <command>dnssec-keygen</command>
+	    will include the key's creation date in the metadata stored
+	    with the private key, and other dates may be set there as well
+	    (publication date, activation date, etc).  Keys that include
+	    this data may be incompatible with older versions of BIND; the
 	    <option>-C</option> option suppresses them.
 	  </para>
 	</listitem>
@@ -277,6 +293,15 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-k</term>
+	<listitem>
+	  <para>
+	    Deprecated in favor of -T KEY.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-L <replaceable class="parameter">ttl</replaceable></term>
 	<listitem>
@@ -293,28 +318,14 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-n <replaceable class="parameter">nametype</replaceable></term>
-	<listitem>
-	  <para>
-	    Specifies the owner type of the key.  The value of
-	    <option>nametype</option> must either be ZONE (for a DNSSEC
-	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
-	    with a host (KEY)), USER (for a key associated with a
-	    user(KEY)) or OTHER (DNSKEY).  These values are case
-	    insensitive.  Defaults to ZONE for DNSKEY generation.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-p <replaceable class="parameter">protocol</replaceable></term>
 	<listitem>
 	  <para>
-	    Sets the protocol value for the generated key, for use
-	    with <option>-T KEY</option>. The protocol is a number between 0
-	    and 255. The default is 3 (DNSSEC). Other possible values for
-	    this argument are listed in RFC 2535 and its successors.
+	    Sets the protocol value for the generated key.  The protocol
+	    is a number between 0 and 255.  The default is 3 (DNSSEC).
+	    Other possible values for this argument are listed in
+	    RFC 2535 and its successors.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -372,6 +383,10 @@
 	    <option>rrtype</option> must be either DNSKEY or KEY.  The
 	    default is DNSKEY when using a DNSSEC algorithm, but it can be
 	    overridden to KEY for use with SIG(0).
+	  <para>
+	  </para>
+	    Specifying any TSIG algorithm (HMAC-* or DH) with
+	    <option>-a</option> forces this option to KEY.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -380,20 +395,10 @@
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>
 	  <para>
-	    Indicates the use of the key, for use with <option>-T
-	    KEY</option>. <option>type</option> must be one of AUTHCONF,
-	    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
-	    refers to the ability to authenticate data, and CONF the ability
-	    to encrypt data.
-	  </para>
-	</listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-V</term>
-	<listitem>
-	  <para>
-	    Prints version information.
+	    Indicates the use of the key.  <option>type</option> must be
+	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
+	    is AUTHCONF.  AUTH refers to the ability to authenticate
+	    data, and CONF the ability to encrypt data.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -407,6 +412,15 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-V</term>
+	<listitem>
+	  <para>
+	    Prints version information.
+	  </para>
+	</listitem>
+      </varlistentry>
+
    </variablelist>
  </refsection>

@@ -571,12 +585,10 @@
      key.
    </para>
    <para>
-      The <filename>.key</filename> file contains a DNSKEY or KEY record.
-      When a zone is being signed by <command>named</command>
-      or <command>dnssec-signzone</command> <option>-S</option>, DNSKEY
-      records are included automatically. In other cases,
-      the <filename>.key</filename> file can be inserted into a zone file
-      manually or with a <userinput>$INCLUDE</userinput> statement.
+      The <filename>.key</filename> file contains a DNS KEY record
+      that
+      can be inserted into a zone file (directly or with a $INCLUDE
+      statement).
    </para>
    <para>
      The <filename>.private</filename> file contains
@@ -584,16 +596,21 @@
      fields.  For obvious security reasons, this file does not have
      general read permission.
    </para>
+    <para>
+      Both <filename>.key</filename> and <filename>.private</filename>
+      files are generated for symmetric cryptography algorithms such as
+      HMAC-MD5, even though the public and private key are equivalent.
+    </para>
  </refsection>

  <refsection><info><title>EXAMPLE</title></info>

    <para>
-      To generate an ECDSAP256SHA256 zone-signing key for the zone
-      <userinput>example.com</userinput>, issue the command:
+      To generate an ECDSAP256SHA256 key for the domain
+      <userinput>example.com</userinput>, the following command would be
+      issued:
    </para>
-    <para>
-      <userinput>dnssec-keygen -a ECDSAP256SHA256 example.com</userinput>
+    <para><userinput>dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com</userinput>
    </para>
    <para>
      The command would print a string of the form:
@@ -606,12 +623,6 @@
      and
      <filename>Kexample.com.+013+26160.private</filename>.
    </para>
-    <para>
-      To generate a matching key-signing key, issue the command:
-    </para>
-    <para>
-      <userinput>dnssec-keygen -a ECDSAP256SHA256 -f KSK example.com</userinput>
-    </para>
  </refsection>

  <refsection><info><title>SEE ALSO</title></info>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -33,10 +33,11 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-keygen</code> 
-       [<code class="option">-3</code>]
-       [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
       [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
+       [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
+       [<code class="option">-3</code>]
+       [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-C</code>]
       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
       [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
@@ -51,7 +52,6 @@
       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
       [<code class="option">-k</code>]
       [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
-       [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
       [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>]
       [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
@@ -62,6 +62,7 @@
       [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
       [<code class="option">-V</code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-z</code>]
       {name}
    </p></div>
  </div>
@@ -94,21 +95,11 @@


    <div class="variablelist"><dl class="variablelist">
-<dt><span class="term">-3</span></dt>
-<dd>
-	  <p>
-	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used with an algorithm that has both
-	    NSEC and NSEC3 versions, then the NSEC3 version will be
-	    used; for example, <span class="command"><strong>dnssec-keygen -3a RSASHA1</strong></span>
-	    specifies the NSEC3RSASHA1 algorithm.
-	  </p>
-	</dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
 	  <p>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
-	    of <code class="option">algorithm</code> must be one of RSASHA1,
+	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    NSEC3RSASHA1, RSASHA256, RSASHA512,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
@@ -139,9 +130,11 @@
 	  <p>
 	    Specifies the number of bits in the key.  The choice of key
 	    size depends on the algorithm used.  RSA keys must be
-	    between 1024 and 4096 bits.  Diffie Hellman keys must be between
-	    128 and 4096 bits.  Elliptic curve algorithms don't need this
-	    parameter.
+	    between 1024 and 2048 bits.  Diffie Hellman keys must be between
+	    128 and 4096 bits.  DSA keys must be between 512 and 1024
+	    bits and an exact multiple of 64.  HMAC keys must be
+	    between 1 and 512 bits. Elliptic curve algorithms don't need
+	    this parameter.
 	  </p>
 	  <p>
 	    If the key size is not specified, some algorithms have
@@ -151,15 +144,36 @@
 	    <code class="option">-f KSK</code>) default to 2048 bits.
 	  </p>
 	</dd>
+<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
+<dd>
+	  <p>
+	    Specifies the owner type of the key.  The value of
+	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
+	    with a host (KEY)), USER (for a key associated with a
+	    user(KEY)) or OTHER (DNSKEY).  These values are case
+	    insensitive.  Defaults to ZONE for DNSKEY generation.
+	  </p>
+	</dd>
+<dt><span class="term">-3</span></dt>
+<dd>
+	  <p>
+	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
+	    If this option is used with an algorithm that has both
+	    NSEC and NSEC3 versions, then the NSEC3 version will be
+	    used; for example, <span class="command"><strong>dnssec-keygen -3a RSASHA1</strong></span>
+	    specifies the NSEC3RSASHA1 algorithm.
+	  </p>
+	</dd>
 <dt><span class="term">-C</span></dt>
 <dd>
 	  <p>
-	    Compatibility mode: generates an old-style key, without any
-	    timing metadata. By default, <span class="command"><strong>dnssec-keygen</strong></span>
-	    will include the key's creation date in the metadata stored with
-	    the private key, and other dates may be set there as well
-	    (publication date, activation date, etc). Keys that include this
-	    data may be incompatible with older versions of BIND; the
+	    Compatibility mode:  generates an old-style key, without
+	    any metadata.  By default, <span class="command"><strong>dnssec-keygen</strong></span>
+	    will include the key's creation date in the metadata stored
+	    with the private key, and other dates may be set there as well
+	    (publication date, activation date, etc).  Keys that include
+	    this data may be incompatible with older versions of BIND; the
 	    <code class="option">-C</code> option suppresses them.
 	  </p>
 	</dd>
@@ -220,6 +234,12 @@
 	    Sets the directory in which the key files are to be written.
 	  </p>
 	</dd>
+<dt><span class="term">-k</span></dt>
+<dd>
+	  <p>
+	    Deprecated in favor of -T KEY.
+	  </p>
+	</dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
 <dd>
 	  <p>
@@ -233,24 +253,13 @@
 	    or <code class="literal">none</code> is the same as leaving it unset.
 	  </p>
 	</dd>
-<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
-<dd>
-	  <p>
-	    Specifies the owner type of the key.  The value of
-	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
-	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
-	    with a host (KEY)), USER (for a key associated with a
-	    user(KEY)) or OTHER (DNSKEY).  These values are case
-	    insensitive.  Defaults to ZONE for DNSKEY generation.
-	  </p>
-	</dd>
 <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
 <dd>
 	  <p>
-	    Sets the protocol value for the generated key, for use
-	    with <code class="option">-T KEY</code>. The protocol is a number between 0
-	    and 255. The default is 3 (DNSSEC). Other possible values for
-	    this argument are listed in RFC 2535 and its successors.
+	    Sets the protocol value for the generated key.  The protocol
+	    is a number between 0 and 255.  The default is 3 (DNSSEC).
+	    Other possible values for this argument are listed in
+	    RFC 2535 and its successors.
 	  </p>
 	</dd>
 <dt><span class="term">-q</span></dt>
@@ -297,21 +306,20 @@
 	    default is DNSKEY when using a DNSSEC algorithm, but it can be
 	    overridden to KEY for use with SIG(0).
 	  </p>
+<p>
+	  </p>
+<p>
+	    Specifying any TSIG algorithm (HMAC-* or DH) with
+	    <code class="option">-a</code> forces this option to KEY.
+	  </p>
 	</dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
 	  <p>
-	    Indicates the use of the key, for use with <code class="option">-T
-	    KEY</code>. <code class="option">type</code> must be one of AUTHCONF,
-	    NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
-	    refers to the ability to authenticate data, and CONF the ability
-	    to encrypt data.
-	  </p>
-	</dd>
-<dt><span class="term">-V</span></dt>
-<dd>
-	  <p>
-	    Prints version information.
+	    Indicates the use of the key.  <code class="option">type</code> must be
+	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
+	    is AUTHCONF.  AUTH refers to the ability to authenticate
+	    data, and CONF the ability to encrypt data.
 	  </p>
 	</dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
@@ -320,6 +328,12 @@
 	    Sets the debugging level.
 	  </p>
 	</dd>
+<dt><span class="term">-V</span></dt>
+<dd>
+	  <p>
+	    Prints version information.
+	  </p>
+	</dd>
 </dl></div>
  </div>

@@ -462,12 +476,10 @@
      key.
    </p>
    <p>
-      The <code class="filename">.key</code> file contains a DNSKEY or KEY record.
-      When a zone is being signed by <span class="command"><strong>named</strong></span>
-      or <span class="command"><strong>dnssec-signzone</strong></span> <code class="option">-S</code>, DNSKEY
-      records are included automatically. In other cases,
-      the <code class="filename">.key</code> file can be inserted into a zone file
-      manually or with a <strong class="userinput"><code>$INCLUDE</code></strong> statement.
+      The <code class="filename">.key</code> file contains a DNS KEY record
+      that
+      can be inserted into a zone file (directly or with a $INCLUDE
+      statement).
    </p>
    <p>
      The <code class="filename">.private</code> file contains
@@ -475,17 +487,22 @@
      fields.  For obvious security reasons, this file does not have
      general read permission.
    </p>
+    <p>
+      Both <code class="filename">.key</code> and <code class="filename">.private</code>
+      files are generated for symmetric cryptography algorithms such as
+      HMAC-MD5, even though the public and private key are equivalent.
+    </p>
  </div>

  <div class="refsection">
 <a name="id-1.11"></a><h2>EXAMPLE</h2>

    <p>
-      To generate an ECDSAP256SHA256 zone-signing key for the zone
-      <strong class="userinput"><code>example.com</code></strong>, issue the command:
+      To generate an ECDSAP256SHA256 key for the domain
+      <strong class="userinput"><code>example.com</code></strong>, the following command would be
+      issued:
    </p>
-    <p>
-      <strong class="userinput"><code>dnssec-keygen -a ECDSAP256SHA256 example.com</code></strong>
+    <p><strong class="userinput"><code>dnssec-keygen -a ECDSAP256SHA256 -n ZONE example.com</code></strong>
    </p>
    <p>
      The command would print a string of the form:
@@ -498,12 +515,6 @@
      and
      <code class="filename">Kexample.com.+013+26160.private</code>.
    </p>
-    <p>
-      To generate a matching key-signing key, issue the command:
-    </p>
-    <p>
-      <strong class="userinput"><code>dnssec-keygen -a ECDSAP256SHA256 -f KSK example.com</code></strong>
-    </p>
  </div>

  <div class="refsection">
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -99,5 +99,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -200,5 +200,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -468,5 +468,5 @@ RFC 4641\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -113,5 +113,5 @@ RFC 4033\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{0EB1727E-2BBD-47A6-AD12-418F9DEB0531}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>cds</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -20,21 +20,18 @@
    <ProjectGuid>{2CB7DC75-023B-4AA3-AF3A-AE5046A4EE70}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>dnssectool</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>StaticLibrary</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{6E6297F4-69D7-4533-85E1-BD17C30017C8}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>dsfromkey</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{AB6690A0-055E-458f-BAC5-BF38BCC5834F}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>importkey</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{17455DC6-5FBB-47C3-8F44-7DB574A188D3}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>keyfromlabel</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{0BF11E21-168C-4CAA-B784-429D126BBAE5}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>keygen</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{D171F185-D3C2-4463-9CF3-ED1D0B1D6832}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>revoke</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{03FB7588-C5A7-4572-968F-14F1206BC69C}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>settime</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{205ED8A9-2E4C-41CC-9385-F3613402AA90}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>signzone</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="@TOOLS_VERSION@" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
      <Configuration>Debug</Configuration>
@@ -14,21 +14,18 @@
    <ProjectGuid>{FD653434-F1A8-44A9-85B2-A7468491DA6D}</ProjectGuid>
    <Keyword>Win32Proj</Keyword>
    <RootNamespace>verify</RootNamespace>
-    @WINDOWS_TARGET_PLATFORM_VERSION@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>true</UseDebugLibraries>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
    <ConfigurationType>Application</ConfigurationType>
    <UseDebugLibraries>false</UseDebugLibraries>
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>MultiByte</CharacterSet>
-    @PLATFORM_TOOLSET@
  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
@@ -46,14 +46,13 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${NS_INCLUDES} ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
-		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
-		@OPENSSL_INCLUDES@
+		${DBDRIVER_INCLUDES} @OPENSSL_INCLUDES@

 CDEFINES =      @CONTRIB_DLZ@

 CWARNINGS =

-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
@@ -86,11 +85,9 @@ SUBDIRS =	unix
 TARGETS =	named@EXEEXT@

 GEOIPLINKOBJS = geoip.@O@
-GEOIP2LINKOBJS = geoip.@O@

 OBJS =		builtin.@O@ config.@O@ control.@O@ \
-		controlconf.@O@ fuzz.@O@ \
-		@GEOIPLINKOBJS@ @GEOIP2LINKOBJS@ \
+		controlconf.@O@ fuzz.@O@ @GEOIPLINKOBJS@ \
 		log.@O@ logconf.@O@ main.@O@ \
 		server.@O@ statschannel.@O@ \
 		tkeyconf.@O@ tsigconf.@O@ zoneconf.@O@ \
@@ -101,11 +98,9 @@ UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
 SYMOBJS =	symtbl.@O@

 GEOIPLINKSRCS = geoip.c
-GEOIP2LINKSRCS = geoip.c

 SRCS =		builtin.c config.c control.c \
-		controlconf.c fuzz.c \
-		@GEOIPLINKSRCS@ @GEOIP2LINKSRCS@ \
+		controlconf.c fuzz.c @GEOIPLINKSRCS@ \
 		log.c logconf.c main.c \
 		server.c statschannel.c \
 		tkeyconf.c tsigconf.c zoneconf.c \
@@ -137,7 +132,6 @@ config.@O@: config.c
 		-DDYNDB_LIBDIR=\"@libdir@/bind\" \
 		-DNAMED_LOCALSTATEDIR=\"${localstatedir}\" \
 		-DNAMED_SYSCONFDIR=\"${sysconfdir}\" \
-		-DMAXMINDDB_PREFIX=\"@MAXMINDDB_PREFIX@\" \
 		-c ${srcdir}/config.c

 server.@O@: server.c
@@ -15,15 +15,6 @@
  <xsl:template match="statistics[@version=&quot;3.11&quot;]">
    <html>
      <head>
-        <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
-        <script type="text/javascript">
-          $(function($) {
-              var wid=0;
-              $('table.zones').each(function(i) { if( $(this).width() > wid ) wid = $(this).width(); return true; });
-              $('table.zones').css('min-width', wid );
-          });
-        </script>
-
        <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
          <!-- Non Mozilla specific markup -->
          <script type="text/javascript" src="https://www.google.com/jsapi"/>
@@ -230,22 +221,6 @@
      background-color: rgb(1,169,206);
      color: #ffffff;
     }
-     table.zones {
-       border: 1px solid grey;
-     }
-     table.zones td {
-       text-align: right;
-       font-family: monospace;
-     }
-     table.zones td:nth-child(2) {
-       text-align: center;
-     }
-     table.zones td:nth-child(3) {
-       text-align: left;
-     }
-     table.zones tr:hover{
-      background-color: #99ddff;
-     }

     td, th {
      padding-right: 5px;
@@ -318,25 +293,25 @@
        <hr/>
        <h2>Server Status</h2>
        <table class="info">
-          <tr class="odd">
+          <tr>
            <th>Boot time:</th>
            <td>
              <xsl:value-of select="server/boot-time"/>
            </td>
          </tr>
-          <tr class="even">
+          <tr>
            <th>Last reconfigured:</th>
            <td>
              <xsl:value-of select="server/config-time"/>
            </td>
          </tr>
-          <tr class="odd">
+          <tr>
            <th>Current time:</th>
            <td>
              <xsl:value-of select="server/current-time"/>
            </td>
          </tr>
-          <tr class="even">
+          <tr>
            <th>Server version:</th>
            <td>
              <xsl:value-of select="server/version"/>
@@ -355,13 +330,7 @@
          <table class="counters">
            <xsl:for-each select="server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0 or substring(@name,1,3) != 'RES']">
              <xsl:sort select="." data-type="number" order="descending"/>
-                <xsl:variable name="css-class0">
-                  <xsl:choose>
-                    <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                    <xsl:otherwise>odd</xsl:otherwise>
-                  </xsl:choose>
-                </xsl:variable>
-                <tr class="{$css-class0}">
+              <tr>
                <th>
                  <xsl:value-of select="@name"/>
                </th>
@@ -642,13 +611,13 @@
            <br/>
          </xsl:if>
        </xsl:for-each>
-        <xsl:if test="traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
          <h2>Traffic Size Statistics</h2>
        </xsl:if>
-        <xsl:if test="traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
          <h4>UDP Requests Received</h4>
          <table class="counters">
-            <xsl:for-each select="traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
              <xsl:variable name="css-class7">
                <xsl:choose>
                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -656,7 +625,6 @@
                </xsl:choose>
              </xsl:variable>
              <tr class="{$css-class7}">
-                <th><xsl:value-of select="local-name(../../..)"/></th>
                <th>
                  <xsl:value-of select="@name"/>
                </th>
@@ -668,10 +636,10 @@
          </table>
          <br/>
        </xsl:if>
-        <xsl:if test="traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
          <h4>UDP Responses Sent</h4>
          <table class="counters">
-            <xsl:for-each select="traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
              <xsl:variable name="css-class7">
                <xsl:choose>
                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -679,7 +647,6 @@
                </xsl:choose>
              </xsl:variable>
              <tr class="{$css-class7}">
-                <th><xsl:value-of select="local-name(../../..)"/></th>
                <th>
                  <xsl:value-of select="@name"/>
                </th>
@@ -691,10 +658,10 @@
          </table>
          <br/>
        </xsl:if>
-        <xsl:if test="traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
          <h4>TCP Requests Received</h4>
          <table class="counters">
-            <xsl:for-each select="traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
              <xsl:variable name="css-class7">
                <xsl:choose>
                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -702,7 +669,6 @@
                </xsl:choose>
              </xsl:variable>
              <tr class="{$css-class7}">
-                <th><xsl:value-of select="local-name(../../..)"/></th>
                <th>
                  <xsl:value-of select="@name"/>
                </th>
@@ -714,10 +680,10 @@
          </table>
          <br/>
        </xsl:if>
-        <xsl:if test="traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+        <xsl:if test="traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
          <h4>TCP Responses Sent</h4>
          <table class="counters">
-            <xsl:for-each select="traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+            <xsl:for-each select="traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
              <xsl:variable name="css-class7">
                <xsl:choose>
                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
@@ -725,7 +691,6 @@
                </xsl:choose>
              </xsl:variable>
              <tr class="{$css-class7}">
-                <th><xsl:value-of select="local-name(../../..)"/></th>
                <th>
                  <xsl:value-of select="@name"/>
                </th>
@@ -759,29 +724,35 @@
          </table>
          <br/>
        </xsl:if>
-        <xsl:if test="views/view/zones/zone">
-          <xsl:for-each select="views/view">
+        <xsl:for-each select="views/view">
+	  <xsl:if test="zones/zone">
            <h3>Zones for View <xsl:value-of select="@name"/></h3>
            <table class="zones">
-              <thead><tr><th>Name</th><th>Class</th><th>Type</th><th>Serial</th></tr></thead>
-              <tbody>
-                <xsl:for-each select="zones/zone">
-                  <xsl:variable name="css-class15">
-                    <xsl:choose>
-                      <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                      <xsl:otherwise>odd</xsl:otherwise>
-                    </xsl:choose>
-                  </xsl:variable>
-                  <tr class="{$css-class15}">
-                      <td><xsl:value-of select="@name"/></td>
-                      <td><xsl:value-of select="@rdataclass"/></td>
-                      <td><xsl:value-of select="type"/></td>
-                      <td><xsl:value-of select="serial"/></td></tr>
-                </xsl:for-each>
-              </tbody>
+              <tr>
+                <th>Name</th>
+                <th>Class</th>
+                <th>Type</th>
+                <th>Serial</th>
+              </tr>
+              <xsl:for-each select="zones/zone">
+                <tr>
+                  <td>
+                    <xsl:value-of select="@name"/>
+                  </td>
+                  <td>
+                    <xsl:value-of select="@rdataclass"/>
+                  </td>
+                  <td>
+                    <xsl:value-of select="type"/>
+                  </td>
+                  <td>
+                    <xsl:value-of select="serial"/>
+                  </td>
+                </tr>
+              </xsl:for-each>
            </table>
-          </xsl:for-each>
-        </xsl:if>
+	  </xsl:if>
+        </xsl:for-each>
        <xsl:if test="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
          <h2>Received QTYPES per view/zone</h2>
          <xsl:for-each select="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
@@ -20,15 +20,6 @@ static char xslmsg[] =
 	" <xsl:template match=\"statistics[@version=&quot;3.11&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
-	" <script type=\"text/javascript\" src=\"https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js\"></script>\n"
-	" <script type=\"text/javascript\">\n"
-	" $(function($) {\n"
-	" var wid=0;\n"
-	" $('table.zones').each(function(i) { if( $(this).width() > wid ) wid = $(this).width(); return true; });\n"
-	" $('table.zones').css('min-width', wid );\n"
-	" });\n"
-	" </script>\n"
-	"\n"
 	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
 	" <!-- Non Mozilla specific markup -->\n"
 	" <script type=\"text/javascript\" src=\"https://www.google.com/jsapi\"/>\n"
@@ -235,22 +226,6 @@ static char xslmsg[] =
 	" background-color: rgb(1,169,206);\n"
 	" color: #ffffff;\n"
 	" }\n"
-	" table.zones {\n"
-	" border: 1px solid grey;\n"
-	" }\n"
-	" table.zones td {\n"
-	" text-align: right;\n"
-	" font-family: monospace;\n"
-	" }\n"
-	" table.zones td:nth-child(2) {\n"
-	" text-align: center;\n"
-	" }\n"
-	" table.zones td:nth-child(3) {\n"
-	" text-align: left;\n"
-	" }\n"
-	" table.zones tr:hover{\n"
-	" background-color: #99ddff;\n"
-	" }\n"
 	"\n"
 	" td, th {\n"
 	" padding-right: 5px;\n"
@@ -323,25 +298,25 @@ static char xslmsg[] =
 	" <hr/>\n"
 	" <h2>Server Status</h2>\n"
 	" <table class=\"info\">\n"
-	" <tr class=\"odd\">\n"
+	" <tr>\n"
 	" <th>Boot time:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/boot-time\"/>\n"
 	" </td>\n"
 	" </tr>\n"
-	" <tr class=\"even\">\n"
+	" <tr>\n"
 	" <th>Last reconfigured:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/config-time\"/>\n"
 	" </td>\n"
 	" </tr>\n"
-	" <tr class=\"odd\">\n"
+	" <tr>\n"
 	" <th>Current time:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/current-time\"/>\n"
 	" </td>\n"
 	" </tr>\n"
-	" <tr class=\"even\">\n"
+	" <tr>\n"
 	" <th>Server version:</th>\n"
 	" <td>\n"
 	" <xsl:value-of select=\"server/version\"/>\n"
@@ -360,13 +335,7 @@ static char xslmsg[] =
 	" <table class=\"counters\">\n"
 	" <xsl:for-each select=\"server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0 or substring(@name,1,3) != 'RES']\">\n"
 	" <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n"
-	" <xsl:variable name=\"css-class0\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class0}\">\n"
+	" <tr>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -647,13 +616,13 @@ static char xslmsg[] =
 	" <br/>\n"
 	" </xsl:if>\n"
 	" </xsl:for-each>\n"
-	" <xsl:if test=\"traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h2>Traffic Size Statistics</h2>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>UDP Requests Received</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic//udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -661,7 +630,6 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
-	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -673,10 +641,10 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>UDP Responses Sent</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic//udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -684,7 +652,6 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
-	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -696,10 +663,10 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>TCP Requests Received</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic//tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -707,7 +674,6 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
-	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -719,10 +685,10 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:if test=\"traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>TCP Responses Sent</h4>\n"
 	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"traffic//tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
+	" <xsl:for-each select=\"traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <xsl:variable name=\"css-class7\">\n"
 	" <xsl:choose>\n"
 	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
@@ -730,7 +696,6 @@ static char xslmsg[] =
 	" </xsl:choose>\n"
 	" </xsl:variable>\n"
 	" <tr class=\"{$css-class7}\">\n"
-	" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
 	" <th>\n"
 	" <xsl:value-of select=\"@name\"/>\n"
 	" </th>\n"
@@ -764,29 +729,35 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	" <xsl:if test=\"views/view/zones/zone\">\n"
 	" <xsl:for-each select=\"views/view\">\n"
+	" <xsl:if test=\"zones/zone\">\n"
 	" <h3>Zones for View <xsl:value-of select=\"@name\"/></h3>\n"
 	" <table class=\"zones\">\n"
-	" <thead><tr><th>Name</th><th>Class</th><th>Type</th><th>Serial</th></tr></thead>\n"
-	" <tbody>\n"
+	" <tr>\n"
+	" <th>Name</th>\n"
+	" <th>Class</th>\n"
+	" <th>Type</th>\n"
+	" <th>Serial</th>\n"
+	" </tr>\n"
 	" <xsl:for-each select=\"zones/zone\">\n"
-	" <xsl:variable name=\"css-class15\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class15}\">\n"
-	" <td><xsl:value-of select=\"@name\"/></td>\n"
-	" <td><xsl:value-of select=\"@rdataclass\"/></td>\n"
-	" <td><xsl:value-of select=\"type\"/></td>\n"
-	" <td><xsl:value-of select=\"serial\"/></td></tr>\n"
+	" <tr>\n"
+	" <td>\n"
+	" <xsl:value-of select=\"@name\"/>\n"
+	" </td>\n"
+	" <td>\n"
+	" <xsl:value-of select=\"@rdataclass\"/>\n"
+	" </td>\n"
+	" <td>\n"
+	" <xsl:value-of select=\"type\"/>\n"
+	" </td>\n"
+	" <td>\n"
+	" <xsl:value-of select=\"serial\"/>\n"
+	" </td>\n"
+	" </tr>\n"
 	" </xsl:for-each>\n"
-	" </tbody>\n"
 	" </table>\n"
-	" </xsl:for-each>\n"
 	" </xsl:if>\n"
+	" </xsl:for-each>\n"
 	" <xsl:if test=\"views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]\">\n"
 	" <h2>Received QTYPES per view/zone</h2>\n"
 	" <xsl:for-each select=\"views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]\">\n"
@@ -66,11 +66,6 @@ options {\n\
 #ifndef WIN32
 "	files unlimited;\n"
 #endif
-#if defined(HAVE_GEOIP2) && !defined(WIN32)
-"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
-#elif defined(HAVE_GEOIP2)
-"	geoip-directory \".\";\n"
-#endif
 "\
 #	has-old-clients <obsolete>;\n\
 	heartbeat-interval 60;\n\
@@ -159,8 +154,11 @@ options {\n\
 #	fetch-glue <obsolete>;\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
-	fetches-per-zone 0;\n\
-	glue-cache yes;\n\
+	fetches-per-zone 0;\n"
+#ifdef HAVE_GEOIP
+"	geoip-use-ecs yes;\n"
+#endif
+"	glue-cache yes;\n\
 	lame-ttl 600;\n"
 #ifdef HAVE_LMDB
 "	lmdb-mapsize 32M;\n"
@@ -883,9 +881,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	if (stack != NULL)
 		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));

-	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
-	INSIST(keycount == dscpcount);

 	ipkl->addrs = addrs;
 	ipkl->dscps = dscps;
@@ -19,7 +19,7 @@
 #ifdef ENABLE_AFL
 #include <named/globals.h>
 #include <named/server.h>
-#include <errno.h>
+#include <sys/errno.h>

 #include <isc/app.h>
 #include <isc/condition.h>
@@ -13,27 +13,20 @@

 #include <config.h>

-#if defined(HAVE_GEOIP2)
-#include <maxminddb.h>
-#elif defined(HAVE_GEOIP)
-#include <GeoIP.h>
-#include <GeoIPCity.h>
-#endif
-
-#include <isc/print.h>
-#include <isc/string.h>
 #include <isc/util.h>

-#include <dns/geoip.h>
-
 #include <named/log.h>
 #include <named/geoip.h>

-static dns_geoip_databases_t geoip_table;
+#include <dns/geoip.h>
+
+#ifdef HAVE_GEOIP
+static dns_geoip_databases_t geoip_table = {
+	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
+};

-#if defined(HAVE_GEOIP)
 static void
-init_geoip_db(void **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
+init_geoip_db(GeoIP **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
 	      GeoIPOptions method, const char *name)
 {
 	char *info;
@@ -41,7 +34,7 @@ init_geoip_db(void **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,

 	REQUIRE(dbp != NULL);

-	db = (GeoIP *)*dbp;
+	db = *dbp;

 	if (db != NULL) {
 		GeoIP_delete(db);
@@ -79,97 +72,32 @@ init_geoip_db(void **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,

 	*dbp = db;
 	return;
-
 fail:
-	if (fallback != 0) {
+	if (fallback != 0)
 		init_geoip_db(dbp, fallback, 0, method, name);
-	}

 }
-#elif defined(HAVE_GEOIP2)
-static MMDB_s geoip_country, geoip_city, geoip_as, geoip_isp, geoip_domain;
-
-static MMDB_s *
-open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
-	char pathbuf[PATH_MAX];
-	unsigned int n;
-	int ret;
-
-	n = snprintf(pathbuf, sizeof(pathbuf), "%s/%s", dir, dbfile);
-	if (n >= sizeof(pathbuf)) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "GeoIP2 database '%s/%s': path too long",
-			      dir, dbfile);
-		return (NULL);
-	}
-
-	ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
-	if (ret == MMDB_SUCCESS) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "opened GeoIP2 database '%s'", pathbuf);
-		return (mmdb);
-	}
-
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
-		      "unable to open GeoIP2 database '%s' (status %d)",
-		      pathbuf, ret);
-
-	return (NULL);
-}
-#endif /* HAVE_GEOIP2 */
-
+#endif /* HAVE_GEOIP */

 void
 named_geoip_init(void) {
-#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
-	if (named_g_geoip == NULL) {
-		named_g_geoip = &geoip_table;
-	}
-#if defined(HAVE_GEOIP)
-	GeoIP_cleanup();
-#endif
-#else
+#ifndef HAVE_GEOIP
 	return;
+#else
+	GeoIP_cleanup();
+	if (named_g_geoip == NULL)
+		named_g_geoip = &geoip_table;
 #endif
 }

 void
 named_geoip_load(char *dir) {
-#if defined(HAVE_GEOIP2)
-	REQUIRE(dir != NULL);
+#ifndef HAVE_GEOIP

-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-		      "looking for GeoIP2 databases in '%s'", dir);
+	UNUSED(dir);

-	named_g_geoip->country = open_geoip2(dir, "GeoIP2-Country.mmdb",
-					     &geoip_country);
-	if (named_g_geoip->country == NULL) {
-		named_g_geoip->country = open_geoip2(dir,
-						     "GeoLite2-Country.mmdb",
-						     &geoip_country);
-	}
-
-	named_g_geoip->city = open_geoip2(dir, "GeoIP2-City.mmdb",
-					  &geoip_city);
-	if (named_g_geoip->city == NULL) {
-		named_g_geoip->city = open_geoip2(dir, "GeoLite2-City.mmdb",
-						  &geoip_city);
-	}
-
-	named_g_geoip->as = open_geoip2(dir, "GeoIP2-ASN.mmdb", &geoip_as);
-	if (named_g_geoip->as == NULL) {
-		named_g_geoip->as = open_geoip2(dir, "GeoLite2-ASN.mmdb",
-						&geoip_as);
-	}
-
-	named_g_geoip->isp = open_geoip2(dir, "GeoIP2-ISP.mmdb", &geoip_isp);
-	named_g_geoip->domain = open_geoip2(dir, "GeoIP2-Domain.mmdb",
-					    &geoip_domain);
-#elif defined(HAVE_GEOIP)
+	return;
+#else
 	GeoIPOptions method;

 #ifdef _WIN32
@@ -213,37 +141,5 @@ named_geoip_load(char *dir) {
 		      method, "Domain");
 	init_geoip_db(&named_g_geoip->netspeed, GEOIP_NETSPEED_EDITION, 0,
 		      method, "NetSpeed");
-#else
-	UNUSED(dir);
-
-	return;
-#endif
-}
-
-void
-named_geoip_shutdown(void) {
-#ifdef HAVE_GEOIP2
-	if (named_g_geoip->country != NULL) {
-		MMDB_close(named_g_geoip->country);
-		named_g_geoip->country = NULL;
-	}
-	if (named_g_geoip->city != NULL) {
-		MMDB_close(named_g_geoip->city);
-		named_g_geoip->city = NULL;
-	}
-	if (named_g_geoip->as != NULL) {
-		MMDB_close(named_g_geoip->as);
-		named_g_geoip->as = NULL;
-	}
-	if (named_g_geoip->isp != NULL) {
-		MMDB_close(named_g_geoip->isp);
-		named_g_geoip->isp = NULL;
-	}
-	if (named_g_geoip->domain != NULL) {
-		MMDB_close(named_g_geoip->domain);
-		named_g_geoip->domain = NULL;
-	}
-#endif /* HAVE_GEOIP2 */
-
-	dns_geoip_shutdown();
+#endif /* HAVE_GEOIP */
 }
@@ -9,15 +9,18 @@
 * information regarding copyright ownership.
 */

-#pragma once
+#ifndef _GEOIP_H
+#define _GEOIP_H

+#ifdef HAVE_GEOIP
+#include <GeoIP.h>
+#include <GeoIPCity.h>
+#endif /* HAVE_GEOIP */
+
+void named_geoip_init(void);
+void named_geoip_load(char *dir);
+
+#ifdef HAVE_GEOIP
 extern dns_geoip_databases_t *named_g_geoip;
-
-void
-named_geoip_init(void);
-
-void
-named_geoip_load(char *dir);
-
-void
-named_geoip_shutdown(void);
+#endif /* HAVE_GEOIP */
+#endif
@@ -154,7 +154,7 @@ EXTERN bool		named_g_keepstderr	INIT(false);

 EXTERN unsigned int		named_g_tat_interval	INIT(24*3600);

-#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
+#ifdef HAVE_GEOIP
 EXTERN dns_geoip_databases_t	*named_g_geoip		INIT(NULL);
 #endif

@@ -358,7 +358,7 @@ save_command_line(int argc, char *argv[]) {
 			 * nearly always be fine.
 			 */
 			if (quoted || isalnum(*src & 0xff) ||
-			    *src == ',' || *src == '-' || *src == '_' ||
+			    *src == '-' || *src == '_' ||
 			    *src == '.' || *src == '/') {
 				*dst++ = *src++;
 				quoted = false;
@@ -611,9 +611,6 @@ parse_T_opt(char *option) {
 		maxudp = 1460;
 	} else if (!strncmp(option, "maxudp=", 7)) {
 		maxudp = atoi(option + 7);
-		if (maxudp <= 0) {
-			named_main_earlyfatal("bad maxudp");
-		}
 	} else if (!strncmp(option, "mkeytimers=", 11)) {
 		p = strtok_r(option + 11, "/", &last);
 		if (p == NULL) {
@@ -1363,17 +1360,6 @@ main(int argc, char *argv[]) {
 	(void) ProfilerStart(NULL);
 #endif

-#ifdef WIN32
-	/*
-	 * Prevent unbuffered I/O from crippling named performance on Windows
-	 * when it is logging to stderr (e.g. in system tests).  Use full
-	 * buffering (_IOFBF) as line buffering (_IOLBF) is unavailable on
-	 * Windows and fflush() is called anyway after each log message gets
-	 * written to the default stderr logging channels created by libisc.
-	*/
-	setvbuf(stderr, NULL, _IOFBF, BUFSIZ);
-#endif
-
 	/*
 	 * Record version in core image.
 	 * strings named.core | grep "named version:"
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -378,5 +378,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2019-07-21
+.\"      Date: 2018-10-23
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2019\-07\-21" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2018\-10\-23" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -209,9 +209,9 @@ options {
 	bindkeys\-file \fIquoted_string\fR;
 	blackhole { \fIaddress_match_element\fR; \&.\&.\&. };
 	cache\-file \fIquoted_string\fR;
-	catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
-	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
-	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
+	catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
+	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
+	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
 	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
@@ -227,7 +227,7 @@ options {
 	check\-wildcard \fIboolean\fR;
 	cleaning\-interval \fIinteger\fR;
 	clients\-per\-query \fIinteger\fR;
-	cookie\-algorithm ( aes | sha1 | sha256 | siphash24 );
+	cookie\-algorithm ( aes | sha1 | sha256 );
 	cookie\-secret \fIstring\fR;
 	coresize ( default | unlimited | \fIsizeval\fR );
 	datasize ( default | unlimited | \fIsizeval\fR );
@@ -265,15 +265,12 @@ options {
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	dnssec\-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder |
-	    resolver | update ) [ ( query | response ) ];
-	    \&.\&.\&. };
-	dnstap\-identity ( \fIquoted_string\fR | none |
-	    hostname );
-	dnstap\-output ( file | unix ) \fIquoted_string\fR [
-	    size ( unlimited | \fIsize\fR ) ] [ versions (
-	    unlimited | \fIinteger\fR ) ] [ suffix ( increment
-	    | timestamp ) ];
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [
+	    ( query | response ) ]; \&.\&.\&. };
+	dnstap\-identity ( \fIquoted_string\fR | none | hostname );
+	dnstap\-output ( file | unix ) \fIquoted_string\fR [ size ( unlimited |
+	    \fIsize\fR ) ] [ versions ( unlimited | \fIinteger\fR ) ] [ suffix (
+	    increment | timestamp ) ];
 	dnstap\-version ( \fIquoted_string\fR | none );
 	dscp \fIinteger\fR;
 	dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
@@ -289,6 +286,9 @@ options {
 	fetches\-per\-server \fIinteger\fR [ ( drop | fail ) ];
 	fetches\-per\-zone \fIinteger\fR [ ( drop | fail ) ];
 	files ( default | unlimited | \fIsizeval\fR );
+	filter\-aaaa { \fIaddress_match_element\fR; \&.\&.\&. };
+	filter\-aaaa\-on\-v4 ( break\-dnssec | \fIboolean\fR );
+	filter\-aaaa\-on\-v6 ( break\-dnssec | \fIboolean\fR );
 	flush\-zones\-on\-shutdown \fIboolean\fR;
 	forward ( first | only );
 	forwarders [ port \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fIipv4_address\fR
@@ -409,18 +409,18 @@ options {
 	resolver\-retry\-interval \fIinteger\fR;
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
-	response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
-	    \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
-	    \fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
-	    nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
+	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
+	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
+	    policy ( cname | disabled | drop | given | no\-op | nodata |
+	    nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
 	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
-	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
-	    min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
-	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
-	    [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
-	    nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
-	    dnsrps\-options { \fIunspecified\-text\fR } ];
+	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
+	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
+	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
+	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ] [
+	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
+	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
+	    } ];
 	root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
@@ -481,18 +481,6 @@ options {
 .if n \{\
 .RE
 .\}
-.SH "PLUGIN"
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-plugin ( query ) \fIstring\fR [ { \fIunspecified\-text\fR
-    } ];
-.fi
-.if n \{\
-.RE
-.\}
 .SH "SERVER"
 .sp
 .if n \{\
@@ -592,9 +580,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	auth\-nxdomain \fIboolean\fR; // default changed
 	auto\-dnssec ( allow | maintain | off );
 	cache\-file \fIquoted_string\fR;
-	catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
-	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
-	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
+	catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
+	    \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
+	    port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
 	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
@@ -647,9 +635,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	dnssec\-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder |
-	    resolver | update ) [ ( query | response ) ];
-	    \&.\&.\&. };
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [
+	    ( query | response ) ]; \&.\&.\&. };
 	dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv4_address\fR [ port
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv6_address\fR [ port
@@ -663,6 +650,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	fetch\-quota\-params \fIinteger\fR \fIfixedpoint\fR \fIfixedpoint\fR \fIfixedpoint\fR;
 	fetches\-per\-server \fIinteger\fR [ ( drop | fail ) ];
 	fetches\-per\-zone \fIinteger\fR [ ( drop | fail ) ];
+	filter\-aaaa { \fIaddress_match_element\fR; \&.\&.\&. };
+	filter\-aaaa\-on\-v4 ( break\-dnssec | \fIboolean\fR );
+	filter\-aaaa\-on\-v6 ( break\-dnssec | \fIboolean\fR );
 	forward ( first | only );
 	forwarders [ port \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fIipv4_address\fR
 	    | \fIipv6_address\fR ) [ port \fIinteger\fR ] [ dscp \fIinteger\fR ]; \&.\&.\&. };
@@ -703,8 +693,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 	max\-udp\-size \fIinteger\fR;
 	max\-zone\-ttl ( unlimited | \fIttlval\fR );
 	message\-compression \fIboolean\fR;
-	min\-cache\-ttl \fIttlval\fR;
-	min\-ncache\-ttl \fIttlval\fR;
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	minimal\-any \fIboolean\fR;
@@ -723,8 +711,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 	nta\-lifetime \fIttlval\fR;
 	nta\-recheck \fIttlval\fR;
 	nxdomain\-redirect \fIstring\fR;
-	plugin ( query ) \fIstring\fR [ {
-	    \fIunspecified\-text\fR } ];
 	preferred\-glue \fIstring\fR;
 	prefetch \fIinteger\fR [ \fIinteger\fR ];
 	provide\-ixfr \fIboolean\fR;
@@ -762,18 +748,18 @@ view \fIstring\fR [ \fIclass\fR ] {
 	resolver\-retry\-interval \fIinteger\fR;
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
-	response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
-	    \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
-	    \fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
-	    nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
+	response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
+	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
+	    policy ( cname | disabled | drop | given | no\-op | nodata |
+	    nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
 	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
-	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
-	    min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
-	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
-	    [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
-	    nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
-	    dnsrps\-options { \fIunspecified\-text\fR } ];
+	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
+	    max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
+	    min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
+	    qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ] [
+	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
+	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
+	    } ];
 	root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
@@ -909,7 +895,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 		notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR
 		    | * ) ] [ dscp \fIinteger\fR ];
 		notify\-to\-soa \fIboolean\fR;
-		pubkey \fIinteger\fR \fIinteger\fR \fIinteger\fR
+		pubkey \fIinteger\fR
+		    \fIinteger\fR
+		    \fIinteger\fR
 		request\-expire \fIboolean\fR;
 		request\-ixfr \fIboolean\fR;
 		serial\-update\-method ( date | increment | unixtime );
@@ -1015,6 +1003,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]
 	    [ dscp \fIinteger\fR ];
 	notify\-to\-soa \fIboolean\fR;
+	pubkey \fIinteger\fR \fIinteger\fR
 	request\-expire \fIboolean\fR;
 	request\-ixfr \fIboolean\fR;
 	serial\-update\-method ( date | increment | unixtime );
@@ -1062,5 +1051,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -13,7 +13,7 @@

 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2019-07-21</date>
+    <date>2018-12-07</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -221,7 +221,7 @@ options {
 	check-wildcard <replaceable>boolean</replaceable>;
 	cleaning-interval <replaceable>integer</replaceable>;
 	clients-per-query <replaceable>integer</replaceable>;
-	cookie-algorithm ( aes | sha1 | sha256 | siphash24 );
+	cookie-algorithm ( aes | sha1 | sha256 );
 	cookie-secret <replaceable>string</replaceable>;
 	coresize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	datasize ( default | unlimited | <replaceable>sizeval</replaceable> );
@@ -403,12 +403,11 @@ options {
 	resolver-retry-interval <replaceable>integer</replaceable>;
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>string</replaceable> [ add-soa <replaceable>boolean</replaceable> ] [ log
-	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval
-	    <replaceable>ttlval</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
-	    nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
-	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
-	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ add-soa <replaceable>boolean</replaceable> ] [
+	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
+	    <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [ policy ( cname |
+	    disabled | drop | given | no-op | nodata | nxdomain | passthru
+	    | tcp-only <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ] [
+	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ]; ... } [
 	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
 	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
 	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
@@ -736,12 +735,11 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	resolver-retry-interval <replaceable>integer</replaceable>;
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>string</replaceable> [ add-soa <replaceable>boolean</replaceable> ] [ log
-	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval
-	    <replaceable>ttlval</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
-	    nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
-	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
-	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ add-soa <replaceable>boolean</replaceable> ] [
+	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
+	    <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [ policy ( cname |
+	    disabled | drop | given | no-op | nodata | nxdomain | passthru
+	    | tcp-only <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ] [
+	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ]; ... } [
 	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
 	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
 	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -190,9 +190,9 @@ options
 	bindkeys-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	blackhole { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
-	catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
-	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
-	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
+	catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
+	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
 	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
@@ -208,7 +208,7 @@ options
 	check-wildcard <em class="replaceable"><code>boolean</code></em>;<br>
 	cleaning-interval <em class="replaceable"><code>integer</code></em>;<br>
 	clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
-	cookie-algorithm ( aes | sha1 | sha256 | siphash24 );<br>
+	cookie-algorithm ( aes | sha1 | sha256 );<br>
 	cookie-secret <em class="replaceable"><code>string</code></em>;<br>
 	coresize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
 	datasize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
@@ -246,15 +246,12 @@ options
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	dnssec-validation ( yes | no | auto );<br>
-	dnstap { ( all | auth | client | forwarder |<br>
-	    resolver | update ) [ ( query | response ) ];<br>
-	    ... };<br>
-	dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none |<br>
-	    hostname );<br>
-	dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [<br>
-	    size ( unlimited | <em class="replaceable"><code>size</code></em> ) ] [ versions (<br>
-	    unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix ( increment<br>
-	    | timestamp ) ];<br>
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [<br>
+	    ( query | response ) ]; ... };<br>
+	dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );<br>
+	dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [ size ( unlimited |<br>
+	    <em class="replaceable"><code>size</code></em> ) ] [ versions ( unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix (<br>
+	    increment | timestamp ) ];<br>
 	dnstap-version ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	dscp <em class="replaceable"><code>integer</code></em>;<br>
 	dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
@@ -270,6 +267,9 @@ options
 	fetches-per-server <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
 	fetches-per-zone <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
 	files ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
+	filter-aaaa { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
+	filter-aaaa-on-v4 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
+	filter-aaaa-on-v6 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
 	flush-zones-on-shutdown <em class="replaceable"><code>boolean</code></em>;<br>
 	forward ( first | only );<br>
 	forwarders [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>ipv4_address</code></em><br>
@@ -390,18 +390,18 @@ options
 	resolver-retry-interval <em class="replaceable"><code>integer</code></em>;<br>
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
-	response-policy { zone <em class="replaceable"><code>string</code></em> [ add-soa <em class="replaceable"><code>boolean</code></em> ] [ log<br>
-	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval<br>
-	    <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
-	    nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
+	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    policy ( cname | disabled | drop | given | no-op | nodata |<br>
+	    nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
 	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ add-soa <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
-	    min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
-	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
-	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> } ];<br>
+	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
+	    } ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
@@ -462,16 +462,7 @@ options
  </div>

  <div class="refsection">
-<a name="id-1.17"></a><h2>PLUGIN</h2>
-
-    <div class="literallayout"><p><br>
-plugin ( query ) <em class="replaceable"><code>string</code></em> [ { <em class="replaceable"><code>unspecified-text</code></em><br>
-    } ];<br>
-</p></div>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.18"></a><h2>SERVER</h2>
+<a name="id-1.17"></a><h2>SERVER</h2>

    <div class="literallayout"><p><br>
 server <em class="replaceable"><code>netprefix</code></em> {<br>
@@ -510,7 +501,7 @@ server
  </div>

  <div class="refsection">
-<a name="id-1.19"></a><h2>STATISTICS-CHANNELS</h2>
+<a name="id-1.18"></a><h2>STATISTICS-CHANNELS</h2>

    <div class="literallayout"><p><br>
 statistics-channels {<br>
@@ -523,7 +514,7 @@ statistics-channels
  </div>

  <div class="refsection">
-<a name="id-1.20"></a><h2>TRUSTED-KEYS</h2>
+<a name="id-1.19"></a><h2>TRUSTED-KEYS</h2>

    <div class="literallayout"><p><br>
 trusted-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
@@ -532,7 +523,7 @@ trusted-keys
  </div>

  <div class="refsection">
-<a name="id-1.21"></a><h2>VIEW</h2>
+<a name="id-1.20"></a><h2>VIEW</h2>

    <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {<br>
@@ -558,9 +549,9 @@ view
 	auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
 	auto-dnssec ( allow | maintain | off );<br>
 	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
-	catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
-	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
-	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
+	catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
+	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
+	    port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
 	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
@@ -613,9 +604,8 @@ view
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	dnssec-validation ( yes | no | auto );<br>
-	dnstap { ( all | auth | client | forwarder |<br>
-	    resolver | update ) [ ( query | response ) ];<br>
-	    ... };<br>
+	dnstap { ( all | auth | client | forwarder | resolver | update ) [<br>
+	    ( query | response ) ]; ... };<br>
 	dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port<br>
@@ -629,6 +619,9 @@ view
 	fetch-quota-params <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>fixedpoint</code></em> <em class="replaceable"><code>fixedpoint</code></em> <em class="replaceable"><code>fixedpoint</code></em>;<br>
 	fetches-per-server <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
 	fetches-per-zone <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
+	filter-aaaa { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
+	filter-aaaa-on-v4 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
+	filter-aaaa-on-v6 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
 	forward ( first | only );<br>
 	forwarders [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>ipv4_address</code></em><br>
 	    | <em class="replaceable"><code>ipv6_address</code></em> ) [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ]; ... };<br>
@@ -669,8 +662,6 @@ view
 	max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
 	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	message-compression <em class="replaceable"><code>boolean</code></em>;<br>
-	min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
-	min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -689,8 +680,6 @@ view
 	nta-lifetime <em class="replaceable"><code>ttlval</code></em>;<br>
 	nta-recheck <em class="replaceable"><code>ttlval</code></em>;<br>
 	nxdomain-redirect <em class="replaceable"><code>string</code></em>;<br>
-	plugin ( query ) <em class="replaceable"><code>string</code></em> [ {<br>
-	    <em class="replaceable"><code>unspecified-text</code></em> } ];<br>
 	preferred-glue <em class="replaceable"><code>string</code></em>;<br>
 	prefetch <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
 	provide-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
@@ -728,18 +717,18 @@ view
 	resolver-retry-interval <em class="replaceable"><code>integer</code></em>;<br>
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
-	response-policy { zone <em class="replaceable"><code>string</code></em> [ add-soa <em class="replaceable"><code>boolean</code></em> ] [ log<br>
-	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval<br>
-	    <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
-	    nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
+	response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    policy ( cname | disabled | drop | given | no-op | nodata |<br>
+	    nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
 	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ add-soa <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
-	    min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
-	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
-	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> } ];<br>
+	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
+	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
+	    } ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
@@ -875,7 +864,9 @@ view
 		notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em><br>
 		    | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
-		pubkey <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+		pubkey <em class="replaceable"><code>integer</code></em><br>
+		    <em class="replaceable"><code>integer</code></em><br>
+		    <em class="replaceable"><code>integer</code></em><br>
 		request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 		request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 		serial-update-method ( date | increment | unixtime );<br>
@@ -909,7 +900,7 @@ view
  </div>

  <div class="refsection">
-<a name="id-1.22"></a><h2>ZONE</h2>
+<a name="id-1.21"></a><h2>ZONE</h2>

    <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {<br>
@@ -978,6 +969,7 @@ zone
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ]<br>
 	    [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
+	pubkey <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 	request-expire <em class="replaceable"><code>boolean</code></em>;<br>
 	request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 	serial-update-method ( date | increment | unixtime );<br>
@@ -1009,14 +1001,14 @@ zone
  </div>

  <div class="refsection">
-<a name="id-1.23"></a><h2>FILES</h2>
+<a name="id-1.22"></a><h2>FILES</h2>

    <p><code class="filename">/etc/named.conf</code>
    </p>
  </div>

  <div class="refsection">
-<a name="id-1.24"></a><h2>SEE ALSO</h2>
+<a name="id-1.23"></a><h2>SEE ALSO</h2>

    <p><span class="citerefentry">
 	<span class="refentrytitle">ddns-confgen</span>(8)
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -41,7 +41,6 @@
 #include <isc/print.h>
 #include <isc/refcount.h>
 #include <isc/resource.h>
-#include <isc/siphash.h>
 #include <isc/socket.h>
 #include <isc/stat.h>
 #include <isc/stats.h>
@@ -109,9 +108,9 @@

 #include <named/config.h>
 #include <named/control.h>
-#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
+#ifdef HAVE_GEOIP
 #include <named/geoip.h>
-#endif /* HAVE_GEOIP || HAVE_GEOIP2 */
+#endif /* HAVE_GEOIP */
 #include <named/log.h>
 #include <named/logconf.h>
 #include <named/main.h>
@@ -166,23 +165,23 @@
 * using it has a 'result' variable and a 'cleanup' label.
 */
 #define CHECK(op) \
-	do { result = (op);					  \
-	       if (result != ISC_R_SUCCESS) goto cleanup;	  \
+	do { result = (op);					 \
+	       if (result != ISC_R_SUCCESS) goto cleanup;	 \
 	} while (0)

 #define TCHECK(op) \
-	do { tresult = (op);					  \
-		if (tresult != ISC_R_SUCCESS) {			  \
-			isc_buffer_clear(*text);		  \
-			goto cleanup;	 			  \
-		}						  \
+	do { tresult = (op);					 \
+		if (tresult != ISC_R_SUCCESS) {			 \
+			isc_buffer_clear(*text);		 \
+			goto cleanup;	 			 \
+		}						 \
 	} while (0)

 #define CHECKM(op, msg) \
 	do { result = (op);					  \
 	       if (result != ISC_R_SUCCESS) {			  \
 			isc_log_write(named_g_lctx,		  \
-				      NAMED_LOGCATEGORY_GENERAL,  \
+				      NAMED_LOGCATEGORY_GENERAL,	  \
 				      NAMED_LOGMODULE_SERVER,	  \
 				      ISC_LOG_ERROR,		  \
 				      "%s: %s", msg,		  \
@@ -195,7 +194,7 @@
 	do { result = (op);					  \
 	       if (result != ISC_R_SUCCESS) {			  \
 			isc_log_write(named_g_lctx,		  \
-				      NAMED_LOGCATEGORY_GENERAL,  \
+				      NAMED_LOGCATEGORY_GENERAL,	  \
 				      NAMED_LOGMODULE_SERVER,	  \
 				      ISC_LOG_ERROR,		  \
 				      "%s '%s': %s", msg, file,	  \
@@ -704,8 +703,7 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,

 static isc_result_t
 dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
-		  bool managed, dst_key_t **target, const char **keynamestrp,
-		  isc_mem_t *mctx)
+		  bool managed, dst_key_t **target, isc_mem_t *mctx)
 {
 	dns_rdataclass_t viewclass;
 	dns_rdata_dnskey_t keystruct;
@@ -723,14 +721,12 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 	dst_key_t *dstkey = NULL;

 	INSIST(target != NULL && *target == NULL);
-	INSIST(keynamestrp != NULL && *keynamestrp == NULL);

 	flags = cfg_obj_asuint32(cfg_tuple_get(key, "flags"));
 	proto = cfg_obj_asuint32(cfg_tuple_get(key, "protocol"));
 	alg = cfg_obj_asuint32(cfg_tuple_get(key, "algorithm"));
 	keyname = dns_fixedname_name(&fkeyname);
 	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
-	*keynamestrp = keynamestr;

 	if (managed) {
 		const char *initmethod;
@@ -764,8 +760,6 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,

 	if (flags > 0xffff)
 		CHECKM(ISC_R_RANGE, "key flags");
-	if (flags & DNS_KEYFLAG_REVOKE)
-		CHECKM(DST_R_BADKEYTYPE, "key flags revoke bit set");
 	if (proto > 0xff)
 		CHECKM(ISC_R_RANGE, "key protocol");
 	if (alg > 0xff)
@@ -805,118 +799,26 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 	return (ISC_R_SUCCESS);

 cleanup:
-	if (dstkey != NULL) {
-		dst_key_free(&dstkey);
-	}
-
-	return (result);
-}
-
-/*%
- * Parse 'key' in the context of view configuration 'vconfig'.  If successful,
- * add the key to 'secroots' if both of the following conditions are true:
- *
- *   - 'keyname_match' is NULL or it matches the owner name of 'key',
- *   - support for the algorithm used by 'key' is not disabled by 'resolver'
- *     for the owner name of 'key'.
- *
- * 'managed' is true for managed keys and false for trusted keys.  'mctx' is
- * the memory context to use for allocating memory.
- */
-static isc_result_t
-process_key(const cfg_obj_t *key, const cfg_obj_t *vconfig,
-	    dns_keytable_t *secroots, const dns_name_t *keyname_match,
-	    dns_resolver_t *resolver, bool managed, isc_mem_t *mctx)
-{
-	const dns_name_t *keyname = NULL;
-	const char *keynamestr = NULL;
-	dst_key_t *dstkey = NULL;
-	unsigned int keyalg;
-	isc_result_t result;
-
-	result = dstkey_fromconfig(vconfig, key, managed, &dstkey, &keynamestr,
-				   mctx);
-
-	switch (result) {
-	case ISC_R_SUCCESS:
-		/*
-		 * Key was parsed correctly, its algorithm is supported by the
-		 * crypto library, and it is not revoked.
-		 */
-		keyname = dst_key_name(dstkey);
-		keyalg = dst_key_alg(dstkey);
-		break;
-	case DST_R_UNSUPPORTEDALG:
-	case DST_R_BADKEYTYPE:
-		/*
-		 * Key was parsed correctly, but it cannot be used; this is not
-		 * a fatal error - log a warning about this key being ignored,
-		 * but do not prevent any further ones from being processed.
-		 */
-		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
-			    "ignoring %s key for '%s': %s",
-			    managed ? "managed" : "trusted",
-			    keynamestr, isc_result_totext(result));
-		return (ISC_R_SUCCESS);
-	case DST_R_NOCRYPTO:
-		/*
-		 * Crypto support is not available.
-		 */
+	if (result == DST_R_NOCRYPTO) {
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
 			    "ignoring %s key for '%s': no crypto support",
 			    managed ? "managed" : "trusted",
 			    keynamestr);
-		return (result);
-	default:
-		/*
-		 * Something unexpected happened; we have no choice but to
-		 * indicate an error so that the configuration loading process
-		 * is interrupted.
-		 */
+	} else if (result == DST_R_UNSUPPORTEDALG) {
+		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
+			    "skipping %s key for '%s': %s",
+			    managed ? "managed" : "trusted",
+			    keynamestr, isc_result_totext(result));
+	} else {
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
 			    "configuring %s key for '%s': %s",
 			    managed ? "managed" : "trusted",
 			    keynamestr, isc_result_totext(result));
-		return (ISC_R_FAILURE);
+		result = ISC_R_FAILURE;
 	}

-	/*
-	 * If the caller requested to only load keys for a specific name and
-	 * the owner name of this key does not match the requested name, do not
-	 * load it.
-	 */
-	if (keyname_match != NULL && !dns_name_equal(keyname_match, keyname)) {
-		goto done;
-	}
-
-	/*
-	 * Ensure that 'resolver' allows using the algorithm of this key for
-	 * its owner name.  If it does not, do not load the key and log a
-	 * warning, but do not prevent further keys from being processed.
-	 */
-	if (!dns_resolver_algorithm_supported(resolver, keyname, keyalg)) {
-		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
-			    "ignoring %s key for '%s': algorithm is disabled",
-			    managed ? "managed" : "trusted", keynamestr);
-		goto done;
-	}
-
-	/*
-	 * Add the key to 'secroots'.  This key is taken from the
-	 * configuration, so if it's a managed key then it's an initializing
-	 * key; that's why 'managed' is duplicated below.
-	 */
-	result = dns_keytable_add(secroots, managed, managed, &dstkey);
-
- done:
-	/*
-	 * Ensure 'dstkey' does not leak.  Note that if dns_keytable_add()
-	 * succeeds, ownership of the key structure is transferred to the key
-	 * table, i.e. 'dstkey' is set to NULL.
-	 */
-	if (dstkey != NULL) {
+	if (dstkey != NULL)
 		dst_key_free(&dstkey);
-	}

 	return (result);
 }
@@ -932,7 +834,8 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 	       const dns_name_t *keyname, isc_mem_t *mctx)
 {
 	const cfg_listelt_t *elt, *elt2;
-	const cfg_obj_t *keylist;
+	const cfg_obj_t *key, *keylist;
+	dst_key_t *dstkey = NULL;
 	isc_result_t result;
 	dns_keytable_t *secroots = NULL;

@@ -948,13 +851,42 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 		     elt2 != NULL;
 		     elt2 = cfg_list_next(elt2))
 		{
-			CHECK(process_key(cfg_listelt_value(elt2), vconfig,
-					  secroots, keyname, view->resolver,
-					  managed, mctx));
+			key = cfg_listelt_value(elt2);
+			result = dstkey_fromconfig(vconfig, key, managed,
+						   &dstkey, mctx);
+			if (result ==  DST_R_UNSUPPORTEDALG) {
+				result = ISC_R_SUCCESS;
+				continue;
+			}
+			if (result != ISC_R_SUCCESS) {
+				goto cleanup;
+			}
+
+			/*
+			 * If keyname was specified, we only add that key.
+			 */
+			if (keyname != NULL &&
+			    !dns_name_equal(keyname, dst_key_name(dstkey)))
+			{
+				dst_key_free(&dstkey);
+				continue;
+			}
+
+			/*
+			 * This key is taken from the configuration, so
+			 * if it's a managed key then it's an
+			 * initializing key; that's why 'managed'
+			 * is duplicated below.
+			 */
+			CHECK(dns_keytable_add(secroots, managed,
+					       managed, &dstkey));
 		}
 	}

 cleanup:
+	if (dstkey != NULL) {
+		dst_key_free(&dstkey);
+	}
 	if (secroots != NULL) {
 		dns_keytable_detach(&secroots);
 	}
@@ -2183,7 +2115,6 @@ configure_rpz_name2(dns_view_t *view, const cfg_obj_t *obj, dns_name_t *name,
 static isc_result_t
 configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 		   bool recursive_only_default,
-		   bool add_soa_default,
 		   dns_ttl_t ttl_default,
 		   uint32_t minupdateinterval_default,
 		   const dns_rpz_zone_t *old,
@@ -2328,13 +2259,6 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 			     !dns_name_equal(&old->cname, &zone->cname)))
 		*old_rpz_okp = false;

-	obj = cfg_tuple_get(rpz_obj, "add-soa");
-	if (cfg_obj_isvoid(obj)) {
-		zone->addsoa = add_soa_default;
-	} else {
-		zone->addsoa = cfg_obj_asboolean(obj);
-	}
-
 	return (ISC_R_SUCCESS);
 }

@@ -2347,7 +2271,7 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 	char *rps_cstr;
 	size_t rps_cstr_size;
 	const cfg_obj_t *sub_obj;
-	bool recursive_only_default, add_soa_default;
+	bool recursive_only_default;
 	bool nsip_enabled, nsdname_enabled;
 	dns_rpz_zbits_t nsip_on, nsdname_on;
 	dns_ttl_t ttl_default;
@@ -2443,13 +2367,6 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 		recursive_only_default = true;
 	}

-	sub_obj = cfg_tuple_get(rpz_obj, "add-soa");
-	if (!cfg_obj_isvoid(sub_obj) && !cfg_obj_asboolean(sub_obj)) {
-		add_soa_default = false;
-	} else {
-		add_soa_default = true;
-	}
-
 	sub_obj = cfg_tuple_get(rpz_obj, "break-dnssec");
 	if (!cfg_obj_isvoid(sub_obj) && cfg_obj_asboolean(sub_obj)) {
 		zones->p.break_dnssec = true;
@@ -2512,7 +2429,6 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 		}
 		result = configure_rpz_zone(view, zone_element,
 					    recursive_only_default,
-					    add_soa_default,
 					    ttl_default,
 					    minupdateinterval_default,
 					    old_zone, old_rpz_okp);
@@ -3739,21 +3655,9 @@ register_one_plugin(const cfg_obj_t *config, const cfg_obj_t *obj,
 		    void *callback_data)
 {
 	dns_view_t *view = callback_data;
-	char full_path[PATH_MAX];
 	isc_result_t result;

-	result = ns_plugin_expandpath(plugin_path,
-				      full_path, sizeof(full_path));
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "%s: plugin configuration failed: "
-			      "unable to get full plugin path: %s",
-			      plugin_path, isc_result_totext(result));
-		return (result);
-	}
-
-	result = ns_plugin_register(full_path, parameters, config,
+	result = ns_plugin_register(plugin_path, parameters, config,
 				    cfg_obj_file(obj), cfg_obj_line(obj),
 				    named_g_mctx, named_g_lctx,
 				    named_g_aclconfctx, view);
@@ -3761,7 +3665,7 @@ register_one_plugin(const cfg_obj_t *config, const cfg_obj_t *obj,
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "%s: plugin configuration failed: %s",
-			      full_path, isc_result_totext(result));
+			      plugin_path, isc_result_totext(result));
 	}

 	return (result);
@@ -5089,9 +4993,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,

 	/*
 	 * Configure default allow-update and allow-update-forwarding ACLs,
-	 * so they can be inherited by zones. (XXX: These are not
-	 * read from the options/view level here. However, they may be
-	 * read from there in zoneconf.c:configure_zone_acl() later.)
+	 * so they can be inherited by zones.  (Note these cannot be set at
+	 * options/view level.)
 	 */
 	if (view->updateacl == NULL) {
 		CHECK(configure_view_acl(NULL, NULL, named_g_config,
@@ -8284,7 +8187,7 @@ load_configuration(const char *filename, named_server_t *server,
 	}
 	isc_socketmgr_setreserved(named_g_socketmgr, reserved);

-#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
+#ifdef HAVE_GEOIP
 	/*
 	 * Initialize GeoIP databases from the configured location.
 	 * This should happen before configuring any ACLs, so that we
@@ -8297,9 +8200,11 @@ load_configuration(const char *filename, named_server_t *server,
 		char *dir;
 		DE_CONST(cfg_obj_asstring(obj), dir);
 		named_geoip_load(dir);
+	} else {
+		named_geoip_load(NULL);
 	}
 	named_g_aclconfctx->geoip = named_g_geoip;
-#endif /* HAVE_GEOIP || HAVE_GEOIP2 */
+#endif /* HAVE_GEOIP */

 	/*
 	 * Configure various server options.
@@ -9063,7 +8968,8 @@ load_configuration(const char *filename, named_server_t *server,
 	{
 		named_g_memstatistics = cfg_obj_asboolean(obj);
 	} else {
-		named_g_memstatistics = true;
+		named_g_memstatistics =
+			((isc_mem_debugging & ISC_MEM_DEBUGRECORD) != 0);
 	}

 	obj = NULL;
@@ -9150,9 +9056,7 @@ load_configuration(const char *filename, named_server_t *server,
 	obj = NULL;
 	result = named_config_get(maps, "cookie-algorithm", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	if (strcasecmp(cfg_obj_asstring(obj), "siphash24") == 0) {
-		server->sctx->cookiealg = ns_cookiealg_siphash24;
-	} else if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) {
+	if (strcasecmp(cfg_obj_asstring(obj), "aes") == 0) {
 		server->sctx->cookiealg = ns_cookiealg_aes;
 	} else if (strcasecmp(cfg_obj_asstring(obj), "sha1") == 0) {
 		server->sctx->cookiealg = ns_cookiealg_sha1;
@@ -9215,18 +9119,12 @@ load_configuration(const char *filename, named_server_t *server,

 			usedlength = isc_buffer_usedlength(&b);
 			switch (server->sctx->cookiealg) {
-			case ns_cookiealg_siphash24:
-				expectedlength = ISC_SIPHASH24_KEY_LENGTH;
-				if (usedlength != expectedlength) {
-					CHECKM(ISC_R_RANGE,
-					       "SipHash-2-4 cookie-secret must be 128 bits");
-				}
-				break;
 			case ns_cookiealg_aes:
 				expectedlength = ISC_AES128_KEYLENGTH;
 				if (usedlength != expectedlength) {
 					CHECKM(ISC_R_RANGE,
-					       "AES cookie-secret must be 128 bits");
+					       "AES cookie-secret must be "
+					       "128 bits");
 				}
 				break;
 			case ns_cookiealg_sha1:
@@ -9509,7 +9407,6 @@ static void
 run_server(isc_task_t *task, isc_event_t *event) {
 	isc_result_t result;
 	named_server_t *server = (named_server_t *)event->ev_arg;
-	dns_geoip_databases_t *geoip;

 	INSIST(task == server->task);

@@ -9520,19 +9417,25 @@ run_server(isc_task_t *task, isc_event_t *event) {

 	dns_dispatchmgr_setstats(named_g_dispatchmgr, server->resolverstats);

-#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
-	geoip = named_g_geoip;
-#else
-	geoip = NULL;
-#endif
-
+#ifdef HAVE_GEOIP
 	CHECKFATAL(ns_interfacemgr_create(named_g_mctx, server->sctx,
 					  named_g_taskmgr, named_g_timermgr,
 					  named_g_socketmgr,
 					  named_g_dispatchmgr,
-					  server->task, named_g_udpdisp, geoip,
+					  server->task, named_g_udpdisp,
+					  named_g_geoip,
 					  &server->interfacemgr),
 		   "creating interface manager");
+#else
+	CHECKFATAL(ns_interfacemgr_create(named_g_mctx, server->sctx,
+					  named_g_taskmgr, named_g_timermgr,
+					  named_g_socketmgr,
+					  named_g_dispatchmgr,
+					  server->task, named_g_udpdisp,
+					  NULL,
+					  &server->interfacemgr),
+		   "creating interface manager");
+#endif

 	CHECKFATAL(isc_timer_create(named_g_timermgr, isc_timertype_inactive,
 				    NULL, NULL, server->task,
@@ -9654,9 +9557,9 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 #ifdef HAVE_DNSTAP
 	dns_dt_shutdown();
 #endif
-#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
-	named_geoip_shutdown();
-#endif /* HAVE_GEOIP || HAVE_GEOIP2 */
+#ifdef HAVE_GEOIP
+	dns_geoip_shutdown();
+#endif

 	dns_db_detach(&server->in_roothints);

@@ -9772,14 +9675,14 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 				    &server->sctx),
 		   "creating server context");

-#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
+#ifdef HAVE_GEOIP
 	/*
 	 * GeoIP must be initialized before the interface
 	 * manager (which includes the ACL environment)
 	 * is created
 	 */
 	named_geoip_init();
-#endif /* HAVE_GEOIP || HAVE_GEOIP2 */
+#endif

 #ifdef ENABLE_AFL
 	server->sctx->fuzztype = named_g_fuzz_type;
@@ -10667,7 +10570,7 @@ add_zone_tolist(dns_zone_t *zone, void *uap) {
 	struct zonelistentry *zle;

 	zle = isc_mem_get(dctx->mctx, sizeof *zle);
-	if (zle == NULL)
+	if (zle ==  NULL)
 		return (ISC_R_NOMEMORY);
 	zle->zone = NULL;
 	dns_zone_attach(zone, &zle->zone);
@@ -10744,21 +10647,17 @@ dumpdone(void *arg, isc_result_t result) {
 	char buf[1024+32];
 	const dns_master_style_t *style;

-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		goto cleanup;
-	}
-	if (dctx->mdctx != NULL) {
+	if (dctx->mdctx != NULL)
 		dns_dumpctx_detach(&dctx->mdctx);
-	}
 	if (dctx->view == NULL) {
 		dctx->view = ISC_LIST_HEAD(dctx->viewlist);
-		if (dctx->view == NULL) {
+		if (dctx->view == NULL)
 			goto done;
-		}
 		INSIST(dctx->zone == NULL);
-	} else {
+	} else
 		goto resume;
-	}
 nextview:
 	fprintf(dctx->fp, ";\n; Start view %s\n;\n", dctx->view->view->name);
 resume:
@@ -10772,9 +10671,8 @@ dumpdone(void *arg, isc_result_t result) {
 	{
 		style = &dns_master_style_cache;
 		/* start cache dump */
-		if (dctx->view->view->cachedb != NULL) {
+		if (dctx->view->view->cachedb != NULL)
 			dns_db_attach(dctx->view->view->cachedb, &dctx->cache);
-		}
 		if (dctx->cache != NULL) {
 			fprintf(dctx->fp,
 				";\n; Cache dump of view '%s' (cache %s)\n;\n",
@@ -10786,52 +10684,43 @@ dumpdone(void *arg, isc_result_t result) {
 							    dctx->task,
 							    dumpdone, dctx,
 							    &dctx->mdctx);
-			if (result == DNS_R_CONTINUE) {
+			if (result == DNS_R_CONTINUE)
 				return;
-			}
-			if (result == ISC_R_NOTIMPLEMENTED) {
+			if (result == ISC_R_NOTIMPLEMENTED)
 				fprintf(dctx->fp, "; %s\n",
 					dns_result_totext(result));
-			} else if (result != ISC_R_SUCCESS) {
+			else if (result != ISC_R_SUCCESS)
 				goto cleanup;
-			}
 		}
 	}

 	if ((dctx->dumpadb || dctx->dumpbad || dctx->dumpfail) &&
-	    dctx->cache == NULL && dctx->view->view->cachedb != NULL) {
+	    dctx->cache == NULL && dctx->view->view->cachedb != NULL)
 		dns_db_attach(dctx->view->view->cachedb, &dctx->cache);
-	}

 	if (dctx->cache != NULL) {
-		if (dctx->dumpadb) {
+		if (dctx->dumpadb)
 			dns_adb_dump(dctx->view->view->adb, dctx->fp);
-		}
-		if (dctx->dumpbad) {
+		if (dctx->dumpbad)
 			dns_resolver_printbadcache(dctx->view->view->resolver,
 						   dctx->fp);
-		}
-		if (dctx->dumpfail) {
+		if (dctx->dumpfail)
 			dns_badcache_print(dctx->view->view->failcache,
 					   "SERVFAIL cache", dctx->fp);
-		}
 		dns_db_detach(&dctx->cache);
 	}
 	if (dctx->dumpzones) {
 		style = &dns_master_style_full;
 nextzone:
-		if (dctx->version != NULL) {
+		if (dctx->version != NULL)
 			dns_db_closeversion(dctx->db, &dctx->version,
 					    false);
-		}
-		if (dctx->db != NULL) {
+		if (dctx->db != NULL)
 			dns_db_detach(&dctx->db);
-		}
-		if (dctx->zone == NULL) {
+		if (dctx->zone == NULL)
 			dctx->zone = ISC_LIST_HEAD(dctx->view->zonelist);
-		} else {
+		else
 			dctx->zone = ISC_LIST_NEXT(dctx->zone, link);
-		}
 		if (dctx->zone != NULL) {
 			/* start zone dump */
 			dns_zone_name(dctx->zone->zone, buf, sizeof(buf));
@@ -10850,9 +10739,8 @@ dumpdone(void *arg, isc_result_t result) {
 							    dctx->task,
 							    dumpdone, dctx,
 							    &dctx->mdctx);
-			if (result == DNS_R_CONTINUE) {
+			if (result == DNS_R_CONTINUE)
 				return;
-			}
 			if (result == ISC_R_NOTIMPLEMENTED) {
 				fprintf(dctx->fp, "; %s\n",
 					dns_result_totext(result));
@@ -10860,31 +10748,26 @@ dumpdone(void *arg, isc_result_t result) {
 				POST(result);
 				goto nextzone;
 			}
-			if (result != ISC_R_SUCCESS) {
+			if (result != ISC_R_SUCCESS)
 				goto cleanup;
-			}
 		}
 	}
-	if (dctx->view != NULL) {
+	if (dctx->view != NULL)
 		dctx->view = ISC_LIST_NEXT(dctx->view, link);
-		if (dctx->view != NULL) {
-			goto nextview;
-		}
-	}
+	if (dctx->view != NULL)
+		goto nextview;
 done:
 	fprintf(dctx->fp, "; Dump complete\n");
 	result = isc_stdio_flush(dctx->fp);
-	if (result == ISC_R_SUCCESS) {
+	if (result == ISC_R_SUCCESS)
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "dumpdb complete");
-	}
 cleanup:
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "dumpdb failed: %s", dns_result_totext(result));
-	}
 	dumpcontext_destroy(dctx);
 }

@@ -11570,13 +11453,13 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 		   ? "ON" : "OFF");
 	CHECK(putstr(text, line));

-	snprintf(line, sizeof(line), "recursive clients: %u/%u/%u\n",
+	snprintf(line, sizeof(line), "recursive clients: %d/%d/%d\n",
 		     isc_quota_getused(&server->sctx->recursionquota),
 		     isc_quota_getsoft(&server->sctx->recursionquota),
 		     isc_quota_getmax(&server->sctx->recursionquota));
 	CHECK(putstr(text, line));

-	snprintf(line, sizeof(line), "tcp clients: %u/%u\n",
+	snprintf(line, sizeof(line), "tcp clients: %d/%d\n",
 		     isc_quota_getused(&server->sctx->tcpquota),
 		     isc_quota_getmax(&server->sctx->tcpquota));
 	CHECK(putstr(text, line));
@@ -14781,13 +14664,13 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 				      "added NTA '%s' (%d sec) in view '%s'",
 				      namebuf, ntattl, view->name);
 		} else {
-			bool wasremoved;
+			bool removed;

 			result = dns_ntatable_delete(ntatable, ntaname);
 			if (result == ISC_R_SUCCESS) {
-				wasremoved = true;
+				removed = true;
 			} else if (result == ISC_R_NOTFOUND) {
-				wasremoved = false;
+				removed = false;
 			} else {
 				goto cleanup;
 			}
@@ -14798,13 +14681,13 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 			first = false;

 			CHECK(putstr(text, "Negative trust anchor "));
-			CHECK(putstr(text, wasremoved ? "removed: "
-						      : "not found: "));
+			CHECK(putstr(text, removed ? "removed: "
+						   : "not found: "));
 			CHECK(putstr(text, namebuf));
 			CHECK(putstr(text, "/"));
 			CHECK(putstr(text, view->name));

-			if (wasremoved) {
+			if (removed) {
 				isc_log_write(named_g_lctx,
 					      NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_SERVER,
@@ -14829,7 +14712,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 		CHECK(ISC_R_NOTFOUND);
 	}

-	(void) putnull(text);
+	CHECK(putnull(text));

 cleanup:
 	if (msg != NULL) {
@@ -15415,14 +15298,13 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 	/* Look for the optional class name. */
 	classtxt = next_token(lex, text);
 	if (classtxt != NULL) {
-		isc_textregion_t r;
-
 		/* Look for the optional view name. */
 		viewtxt = next_token(lex, text);
+	}
+
+	if (classtxt != NULL) {
+		isc_textregion_t r;

-		/*
-		 * If 'classtext' is not a valid class then it us a view name.
-		 */
 		r.base = classtxt;
 		r.length = strlen(classtxt);
 		result = dns_rdataclass_fromtext(&rdclass, &r);
@@ -1246,12 +1246,6 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 #endif
 }

-static bool
-rdatastatstype_attr(dns_rdatastatstype_t type, unsigned int attr)
-{
-	return ((DNS_RDATASTATSTYPE_ATTR(type) & attr) != 0);
-}
-
 static void
 rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	stats_dumparg_t *dumparg = arg;
@@ -1260,7 +1254,6 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	const char *typestr;
 	bool nxrrset = false;
 	bool stale = false;
-	bool ancient = false;
 #ifdef HAVE_LIBXML2
 	xmlTextWriterPtr writer;
 	int xmlrc;
@@ -1282,16 +1275,19 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 		typestr = typebuf;
 	}

-	nxrrset = rdatastatstype_attr(type, DNS_RDATASTATSTYPE_ATTR_NXRRSET);
-	stale = rdatastatstype_attr(type, DNS_RDATASTATSTYPE_ATTR_STALE);
-	ancient = rdatastatstype_attr(type, DNS_RDATASTATSTYPE_ATTR_ANCIENT);
+	if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_NXRRSET)
+	    != 0)
+		nxrrset = true;
+
+	if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_STALE)
+	    != 0)
+		stale = true;

 	switch (dumparg->type) {
 	case isc_statsformat_file:
 		fp = dumparg->arg;
-		fprintf(fp, "%20" PRIu64 " %s%s%s%s\n", val,
-			ancient ? "~" : "", stale ? "#" : "",
-			nxrrset ? "!" : "", typestr);
+		fprintf(fp, "%20" PRIu64 " %s%s%s\n", val,
+			stale ? "#" : "", nxrrset ? "!" : "", typestr);
 		break;
 	case isc_statsformat_xml:
 #ifdef HAVE_LIBXML2
@@ -1299,8 +1295,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {

 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rrset"));
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"));
-		TRY0(xmlTextWriterWriteFormatString(writer, "%s%s%s%s",
-					       ancient ? "~" : "",
+		TRY0(xmlTextWriterWriteFormatString(writer, "%s%s%s",
 					       stale ? "#" : "",
 					       nxrrset ? "!" : "", typestr));
 		TRY0(xmlTextWriterEndElement(writer)); /* name */
@@ -1317,7 +1312,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	case isc_statsformat_json:
 #ifdef HAVE_JSON
 		zoneobj = (json_object *) dumparg->arg;
-		snprintf(buf, sizeof(buf), "%s%s%s%s", ancient ? "~" : "",
+		snprintf(buf, sizeof(buf), "%s%s%s",
 			 stale ? "#" : "", nxrrset ? "!" : "", typestr);
 		obj = json_object_new_int64(val);
 		if (obj == NULL)
@@ -1451,62 +1446,6 @@ rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {
 #endif
 }

-#if defined(EXTENDED_STATS)
-static void
-dnssecsignstat_dump(dns_keytag_t tag, uint64_t val, void *arg) {
-	FILE *fp;
-	char tagbuf[64];
-	stats_dumparg_t *dumparg = arg;
-#ifdef HAVE_LIBXML2
-	xmlTextWriterPtr writer;
-	int xmlrc;
-#endif
-#ifdef HAVE_JSON
-	json_object *zoneobj, *obj;
-#endif
-
-	snprintf(tagbuf, sizeof(tagbuf), "%u", tag);
-
-	switch (dumparg->type) {
-	case isc_statsformat_file:
-		fp = dumparg->arg;
-		fprintf(fp, "%20" PRIu64 " %s\n", val, tagbuf);
-		break;
-	case isc_statsformat_xml:
-#ifdef HAVE_LIBXML2
-		writer = dumparg->arg;
-		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter"));
-		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "name",
-						 ISC_XMLCHAR tagbuf ));
-		TRY0(xmlTextWriterWriteFormatString(writer,
-						"%" PRIu64,
-						val));
-		TRY0(xmlTextWriterEndElement(writer)); /* counter */
-#endif
-		break;
-	case isc_statsformat_json:
-#ifdef HAVE_JSON
-		zoneobj = (json_object *) dumparg->arg;
-		obj = json_object_new_int64(val);
-		if (obj == NULL) {
-			return;
-		}
-		json_object_object_add(zoneobj, tagbuf, obj);
-#endif
-		break;
-	}
-	return;
-#ifdef HAVE_LIBXML2
- error:
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-		      "failed at dnssecsignstat_dump()");
-	dumparg->result = ISC_R_FAILURE;
-	return;
-#endif
-}
-#endif /* defined(EXTENDED_STATS) */
-
 #ifdef HAVE_LIBXML2
 /*
 * Which statistics to include when rendering to XML
@@ -1569,8 +1508,6 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_stats_t *zonestats;
 		isc_stats_t *gluecachestats;
 		dns_stats_t *rcvquerystats;
-		dns_stats_t *dnssecsignstats;
-		dns_stats_t *dnssecrefreshstats;
 		uint64_t nsstat_values[ns_statscounter_max];
 		uint64_t gluecachestats_values[dns_gluecachestatscounter_max];

@@ -1598,8 +1535,8 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 			TRY0(xmlTextWriterStartElement(writer,
 						       ISC_XMLCHAR "counters"));
 			TRY0(xmlTextWriterWriteAttribute(writer,
-						      ISC_XMLCHAR "type",
-						      ISC_XMLCHAR "gluecache"));
+							 ISC_XMLCHAR "type",
+							 ISC_XMLCHAR "gluecache"));

 			result = dump_counters(gluecachestats,
 					       isc_statsformat_xml,
@@ -1632,46 +1569,6 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 			/* counters type="qtype"*/
 			TRY0(xmlTextWriterEndElement(writer));
 		}
-
-		dnssecsignstats = dns_zone_getdnssecsignstats(zone);
-		if (dnssecsignstats != NULL) {
-			TRY0(xmlTextWriterStartElement(writer,
-						       ISC_XMLCHAR "counters"));
-			TRY0(xmlTextWriterWriteAttribute(writer,
-						    ISC_XMLCHAR "type",
-						    ISC_XMLCHAR "dnssec-sign"));
-
-			dumparg.result = ISC_R_SUCCESS;
-			dns_dnssecsignstats_dump(dnssecsignstats,
-						 dnssecsignstat_dump,
-						 &dumparg, 0);
-			if(dumparg.result != ISC_R_SUCCESS) {
-				goto error;
-			}
-
-			/* counters type="dnssec-sign"*/
-			TRY0(xmlTextWriterEndElement(writer));
-		}
-
-		dnssecrefreshstats = dns_zone_getdnssecrefreshstats(zone);
-		if (dnssecrefreshstats != NULL) {
-			TRY0(xmlTextWriterStartElement(writer,
-						       ISC_XMLCHAR "counters"));
-			TRY0(xmlTextWriterWriteAttribute(writer,
-						 ISC_XMLCHAR "type",
-						 ISC_XMLCHAR "dnssec-refresh"));
-
-			dumparg.result = ISC_R_SUCCESS;
-			dns_dnssecsignstats_dump(dnssecrefreshstats,
-						 dnssecsignstat_dump,
-						 &dumparg, 0);
-			if(dumparg.result != ISC_R_SUCCESS) {
-				goto error;
-			}
-
-			/* counters type="dnssec-refresh"*/
-			TRY0(xmlTextWriterEndElement(writer));
-		}
 	}

 	TRY0(xmlTextWriterEndElement(writer)); /* zone */
@@ -2392,8 +2289,6 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 		isc_stats_t *zonestats;
 		isc_stats_t *gluecachestats;
 		dns_stats_t *rcvquerystats;
-		dns_stats_t *dnssecsignstats;
-		dns_stats_t *dnssecrefreshstats;
 		uint64_t nsstat_values[ns_statscounter_max];
 		uint64_t gluecachestats_values[dns_gluecachestatscounter_max];

@@ -2471,58 +2366,6 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 			else
 				json_object_put(counters);
 		}
-
-		dnssecsignstats = dns_zone_getdnssecsignstats(zone);
-		if (dnssecsignstats != NULL) {
-			stats_dumparg_t dumparg;
-			json_object *counters = json_object_new_object();
-			CHECKMEM(counters);
-
-			dumparg.type = isc_statsformat_json;
-			dumparg.arg = counters;
-			dumparg.result = ISC_R_SUCCESS;
-			dns_dnssecsignstats_dump(dnssecsignstats,
-						 dnssecsignstat_dump,
-						 &dumparg, 0);
-			if (dumparg.result != ISC_R_SUCCESS) {
-				json_object_put(counters);
-				goto error;
-			}
-
-			if (json_object_get_object(counters)->count != 0) {
-				json_object_object_add(zoneobj,
-						       "dnssec-sign",
-						       counters);
-			} else {
-				json_object_put(counters);
-			}
-		}
-
-		dnssecrefreshstats = dns_zone_getdnssecrefreshstats(zone);
-		if (dnssecrefreshstats != NULL) {
-			stats_dumparg_t dumparg;
-			json_object *counters = json_object_new_object();
-			CHECKMEM(counters);
-
-			dumparg.type = isc_statsformat_json;
-			dumparg.arg = counters;
-			dumparg.result = ISC_R_SUCCESS;
-			dns_dnssecsignstats_dump(dnssecrefreshstats,
-						 dnssecsignstat_dump,
-						 &dumparg, 0);
-			if (dumparg.result != ISC_R_SUCCESS) {
-				json_object_put(counters);
-				goto error;
-			}
-
-			if (json_object_get_object(counters)->count != 0) {
-				json_object_object_add(zoneobj,
-						       "dnssec-refresh",
-						       counters);
-			} else {
-				json_object_put(counters);
-			}
-		}
 	}

 	json_object_array_add(zonearray, zoneobj);
@@ -3582,10 +3425,6 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,

 	ISC_LIST_INIT(new_listeners);

-#ifdef HAVE_LIBXML2
-	xmlInitThreads();
-#endif /* HAVE_LIBXML2 */
-
 	/*
 	 * Get the list of named.conf 'statistics-channels' statements.
 	 */
@@ -3718,10 +3557,6 @@ named_statschannels_shutdown(named_server_t *server) {
 		ISC_LIST_UNLINK(server->statschannels, listener, link);
 		shutdown_listener(listener);
 	}
-
-#ifdef HAVE_LIBXML2
-	xmlCleanupThreads();
-#endif /* HAVE_LIBXML2 */
 }

 isc_result_t
@@ -17,9 +17,7 @@
 #include <inttypes.h>
 #include <stdlib.h>
 #include <string.h>
-#if HAVE_DLFCN_H
 #include <dlfcn.h>
-#endif

 #include <dns/log.h>
 #include <dns/result.h>
@@ -41,11 +41,6 @@
      <Filter>Source Files</Filter>
    </ClCompile>
@END GEOIP
-@IF GEOIPLEGACY
-    <ClCompile Include="..\geoip.c">
-      <Filter>Source Files</Filter>
-    </ClCompile>
-@END GEOIPLEGACY
    <ClCompile Include="..\log.c">
      <Filter>Source Files</Filter>
    </ClCompile>
@@ -92,11 +87,6 @@
      <Filter>Header Files</Filter>
    </ClInclude>
@END GEOIP
-@IF GEOIPLEGACY
-    <ClInclude Include="..\include\named\geoip.h">
-      <Filter>Header Files</Filter>
-    </ClInclude>
-@END GEOIPLEGACY
    <ClInclude Include="..\include\named\globals.h">
      <Filter>Header Files</Filter>
    </ClInclude>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ondřej SurýandEvan Hunt	d7f4a59c28	Split generic and local deleted files	2019-02-05 21:32:00 -08:00
Ondřej SurýandMark Andrews	55e0c0e461	Simplify the inline clean script	2019-02-06 16:24:39 +11:00
Mark Andrews	c8dd6c82a3	clean K* files in inline system test directory	2019-02-06 16:24:39 +11:00